Hello jdow, Tuesday, October 12, 2004, 3:38:35 PM, you responded to "martin f krafft" <[EMAIL PROTECTED]>
j> ... But posting new examples of j> spam that escape the filters is worthwhile. Back when we were not j> stuck with the Apache.org sysadmins I noticed that the SARE rules j> got updated far more frequently and quickly in the face of new j> threats. In those days the new types of spam that escaped tests j> were forwarded to the list and new rules were developed almost j> instantly. j> Now that getting messages to the SARE people violates the 20-20 j> rule the updates are seriously lagging. (The 20-20 rule states that j> if something is more than 20' or 20 seconds out of the way people j> will tend to avoid it. It's an effective way to hide in a corporate j> environment, for example.) Posting a message to your web site and j> composing a message about it is beyond 20 seconds out of the way j> for the poster and more than 20 seconds out of the way for the SARE j> people. So updates come less frequently. Actually, there's a lot of variability in the SARE process, and some updates can sometimes come very quickly. For instance, I've developed a strong dislike for the spammers at Word Of Mouth, and as the person who maintains SARE's specific.cf file, I will gladly jump at any WoM spam with new patterns and add them to the config file. I've been known to publish updates within 24 hours after a new pattern hits the 'net. But I've been on the road since Oct 7, and may not return home until or even after All Hollow's Eve. I'm therefore very limited in my ability to respond to new spam right now. More generally, with the advances made through SURBL and other SA 3.0 improvements, there's less need for rapid response rules. Some of us are therefore spending time on other things rather than fighting spam 25 hours a day. Still, if there's spam worth fighting, let us know about it. Bob Menschel
