Chris Santerre wrote:
These stock spams are usually dead easy to catch with spam
assassin, but
there's no "quick response" rules database available to get a
new rule.
It's a battle of hours, not days with these stock spams.
There is, we just haven't been updating it.
Any thoughts on how to best address this issue, other than every SA
admin on the planet writing their own rules every evening?
I'd note that
these are not identical spams, but are somewhat limited in their
'variety', and they are hitting DCC now.
Yeah, we are gong to start updating again.
Also, it's clear from several other lists, that commercial
applications
are fairing no better than SA in stopping these.
Telling users that 'yeah, we got dozens of those too, but we are
catching them now', isn't really a very good approach.
If you happen to know what spammers are going to send, before they send it,
please let us know about it.
Chris,
SARE does a great job with SA rules and testing, but you know, it
doesn't hurt to kick the tires now and then? Sometimes the best ideas
come about this way.
Now, how to know what spammers are going to send before they send it..
That doesn't sound like an open source project. ;-)
Thanks,
Ken A.
Thanks,
Chris Santerre
SysAdmin and Spamfighter
www.rulesemporium.com
www.uribl.com
