Re: ATTN DEVELOPERS: Mega-Spam

2010-03-30 Thread Jonas Eckerman
On 2010-03-30 01:29, Brent Kennedy wrote: Graylisting does work. I know it works. That's why I said I like it because it stops spam. Been using my own implementation for years. I think after I turned it on, the botnet plug-in got bored. My stats for it dropped significantly. So that’s

Re: ATTN DEVELOPERS: Mega-Spam

2010-03-30 Thread Kai Schaetzl
Jonas Eckerman wrote on Tue, 30 Mar 2010 11:52:43 +0200: I suspect that If the botnets were short on bandwidth and computer power, the programmers would have fix those issues a long time ago. And the simple fact that they still haven't adapted to greylisting indicates that it's impact is

Re: ATTN DEVELOPERS: Mega-Spam

2010-03-30 Thread Kai Schaetzl
Jonas Eckerman wrote on Tue, 30 Mar 2010 00:41:01 +0200: Unless the greylisting is done *after* receiving the body. Of course, this will spank innocent senders as well. Ooops? It spanks *yourself*. Good strategy. Kai -- Get your web at Conactive Internet Services: http://www.conactive.com

Re: ATTN DEVELOPERS: Mega-Spam

2010-03-30 Thread Jonas Eckerman
On 2010-03-30 13:31, Kai Schaetzl wrote: Jonas Eckerman wrote on Tue, 30 Mar 2010 00:41:01 +0200: Unless the greylisting is done *after* receiving the body. Of course, this will spank innocent senders as well. Ooops? It spanks *yourself*. Not really. It does force us to accept the mail

Re: ATTN DEVELOPERS: Mega-Spam

2010-03-30 Thread John Hardin
On Tue, 30 Mar 2010, Jonas Eckerman wrote: On 2010-03-30 01:29, Brent Kennedy wrote: I think after I turned it on, the botnet plug-in got bored. My stats for it dropped significantly. So that’s my proof it does adversely affect botnets. No, that's your proof that it has a positive

ATTN DEVELOPERS: Mega-Spam

2010-03-29 Thread Charles Gregory
Literally, Mega-Spam. I just got a spam with 1MB of images. My suggestion has been made before, but I would like to ask that it now be taken a bit more seriously. SA needs an option to allow efficient 'partial' scanning of large e-mails, so that, for example, we can peform all the valuable

Re: ATTN DEVELOPERS: Mega-Spam

2010-03-29 Thread Michael Scheidell
On 3/29/10 1:09 PM, Charles Gregory wrote: Literally, Mega-Spam. I just got a spam with 1MB of images. My suggestion has been made before, but I would like to ask that it now be taken a bit more seriously. SA needs an option to allow efficient 'partial' scanning of large e-mails, so that,

Re: ATTN DEVELOPERS: Mega-Spam

2010-03-29 Thread Karsten Bräckelmann
Aw, is that shouting really necessary? Oh, yes, it is indeed -- you are trying to get heard over on the dev list, so you need to be quite loud from here... ;) The dev list is what you want. On Mon, 2010-03-29 at 13:09 -0400, Charles Gregory wrote: Literally, Mega-Spam. I just got a spam with

RE: ATTN DEVELOPERS: Mega-Spam

2010-03-29 Thread Brent Kennedy
-in. It would be good if SA could handle this though. The above are only temporary solutions to a bigger problem. -Brent -Original Message- From: Charles Gregory [mailto:cgreg...@hwcn.org] Sent: Monday, March 29, 2010 1:09 PM To: users@spamassassin.apache.org Subject: ATTN DEVELOPERS

RE: ATTN DEVELOPERS: Mega-Spam

2010-03-29 Thread Karsten Bräckelmann
On Mon, 2010-03-29 at 16:23 -0400, Brent Kennedy wrote: Wow, I knew this was coming at some point. I just figured it was too expensive. You did read the entire thread, right? :) There's nothing new about this. Moreover, this still is a rare occurrence. Note even Charles, who started this

Re: ATTN DEVELOPERS: Mega-Spam

2010-03-29 Thread Charles Gregory
On Mon, 29 Mar 2010, Karsten Bräckelmann wrote: You did read the entire thread, right? :) There's nothing new about this. Moreover, this still is a rare occurrence. Note even Charles, who started this thread, claims to have received *one* such spam. And it appears to be his first. ;) Last

Re: ATTN DEVELOPERS: Mega-Spam

2010-03-29 Thread Mathias Homann
Am Montag 29 März 2010 schrieb Karsten Bräckelmann: On Mon, 2010-03-29 at 16:23 -0400, Brent Kennedy wrote: Wow, I knew this was coming at some point. I just figured it was too expensive. You did read the entire thread, right? :) There's nothing new about this. Moreover, this still is a

Re: ATTN DEVELOPERS: Mega-Spam

2010-03-29 Thread Karsten Bräckelmann
On Mon, 2010-03-29 at 16:57 -0400, Charles Gregory wrote: The spams I've seen so far look more 'amateur' than 'pro'. Easily tracable IP's. Blacklistable domains. I'm just throwing my idea into the queue now so that it can be smoothly integrated with a future release. We've got plenty of

Re: ATTN DEVELOPERS: Mega-Spam

2010-03-29 Thread Martin Gregorie
On Mon, 2010-03-29 at 23:01 +0200, Mathias Homann wrote: I think it has, I get about 2-5 mega spams per day by now. and I can't do greylisting because I have to fetchmail from a central mail server at my hoster that is not under my direct control. And no, moving from a vhost to a root server

RE: ATTN DEVELOPERS: Mega-Spam

2010-03-29 Thread John Hardin
On Mon, 29 Mar 2010, Brent Kennedy wrote: My suggestion would be to use graylisting, force them to send that 1MB message twice. While greylisting will help, it won't spank the offender in that manner. It will postpone the message very early in the SMTP exchange, not after the body has been

Re: ATTN DEVELOPERS: Mega-Spam

2010-03-29 Thread Mark Martinec
We've got plenty of time, but I suggest not waiting until it becomes a big problem before desperately rushing to fix it :) Depends on how one defines where a problem starts to become 'big'. For me the problem of large messages was big enough early last year so that I had to implement a

Re: ATTN DEVELOPERS: Mega-Spam

2010-03-29 Thread Jonas Eckerman
On 2010-03-30 00:12, John Hardin wrote: While greylisting will help, it won't spank the offender in that manner. It will postpone the message very early in the SMTP exchange, not after the body has been received. Unless the greylisting is done *after* receiving the body. Of course, this will

RE: ATTN DEVELOPERS: Mega-Spam

2010-03-29 Thread Brent Kennedy
every now and then. Ahh but the learning db might be an issue oh well just a thought. -Brent -Original Message- From: Jonas Eckerman [mailto:jonas_li...@frukt.org] Sent: Monday, March 29, 2010 6:41 PM To: John Hardin Subject: Re: ATTN DEVELOPERS: Mega-Spam On 2010-03-30 00:12, John

RE: ATTN DEVELOPERS: Mega-Spam

2010-03-29 Thread John Hardin
On Mon, 29 Mar 2010, Brent Kennedy wrote: Ya know, this got me thinking. Wonder if I could create a VM with all the settings and a script to customize the setup. Then organizations could just deploy the VM. Sort of an all in one deployment. Just update the VM template every now and then.