Mailing List Archive

At 13:02 2004/03/05, Martin Lyberg wrote:

>One thing came to my mind today. When i read that some of you catch alot of
>spams everyday, are you people going through this mailbox everday day for
>FP's? I'm doing it, but i only recieve about 80-100 spams a day. Some of you
>may get several thousands every day.
>
>Or are you just waiting for people to call you looking for that mail that
>never came through? :)

Two words: quarantine management :)

I know there are still a lot of old school admins out there that still
prefer to manage content filtering and quarantine management themselves,
but to my mind that's not the way this sort of thing should be handled, and
as you point out it's not a scalable solution.

What I advocate is letting the end users control their content filtering
settings and manage their own quarantines. Give them the tools to do so,
make them easy to use, and it takes the administrative burden off the
shoulders of a few admins and distributes it across the user base. Instead
of forcing an admin to spend an hour (or more) a day sifting through a
system-wide quarantine, let each user spend 30 seconds a day dealing with
it. What the users neglect can be auto-expired at regular intervals (say,
weekly), so the administrative overhead drops to almost nil.

A number of the commercial anti-spam solutions are moving (albeit slowly)
in this direction. To address this need for my own purposes, I developed
Maia Mailguard (http://www.renaissoft.com/maia/), an open source quarantine
management solution based on amavisd-new and SpamAssassin, which has proven
popular among ISPs and webmail providers.


Robert LeBlanc <rjl@renaissoft.com>
Renaissoft, Inc.
Maia Mailguard <http://www.renaissoft.com/maia/>

Martin Lyberg said:
> Hi!
>
> One thing came to my mind today. When i read that some of you catch alot
> of
> spams everyday, are you people going through this mailbox everday day for
> FP's? I'm doing it, but i only recieve about 80-100 spams a day. Some of
> you
> may get several thousands every day.

Hi Martin.

I do check for FP (although my spam rate is much lower than many on this
list) as they come in. However, I only check emails tagged between 5.0
and 10.0. Anything above 10.0 is automatically fed to bayes and archived.
I'd say about 1 in 10 spam are tagged between 5.0 and 10.0 the other 9.99
are >= 10.0 and probably less than one per month actually hit my inbox.

Here is what contributes to my scores in order of effectiveness: well
trained bayes DB, sender RBL lookups, Distributed checksums, 3rd party
rulesets, custom rules, URL RBL lookups.

> Or are you just waiting for people to call you looking for that mail that
> never came through? :)



--
Chris Thielen

Easily generate SpamAssassin rules to catch obfuscated spam phrases
(0BFU$C/\TED SPA/\/\ P|-|RA$ES):
http://www.sandgnat.com/cmos/

We redirect spam, if the users so request, into the Trash folder of the IMAP
server. That way, it's available if they want it, and it's automagically
cleaned out after a week if they don't. Simple, elegant, no hassle.



-----Original Message-----
From: Robert LeBlanc [mailto:rjl@renaissoft.com]
Sent: Friday, March 05, 2004 4:15 PM
To: Martin Lyberg; 'spamassassin-users@incubator.apache.org'
Subject: Re: Going through spam


At 13:02 2004/03/05, Martin Lyberg wrote:

>One thing came to my mind today. When i read that some of you catch alot of
>spams everyday, are you people going through this mailbox everday day for
>FP's? I'm doing it, but i only recieve about 80-100 spams a day. Some of
you
>may get several thousands every day.
>
>Or are you just waiting for people to call you looking for that mail that
>never came through? :)

Two words: quarantine management :)

I know there are still a lot of old school admins out there that still
prefer to manage content filtering and quarantine management themselves,
but to my mind that's not the way this sort of thing should be handled, and
as you point out it's not a scalable solution.

What I advocate is letting the end users control their content filtering
settings and manage their own quarantines. Give them the tools to do so,
make them easy to use, and it takes the administrative burden off the
shoulders of a few admins and distributes it across the user base. Instead
of forcing an admin to spend an hour (or more) a day sifting through a
system-wide quarantine, let each user spend 30 seconds a day dealing with
it. What the users neglect can be auto-expired at regular intervals (say,
weekly), so the administrative overhead drops to almost nil.

A number of the commercial anti-spam solutions are moving (albeit slowly)
in this direction. To address this need for my own purposes, I developed
Maia Mailguard (http://www.renaissoft.com/maia/), an open source quarantine
management solution based on amavisd-new and SpamAssassin, which has proven
popular among ISPs and webmail providers.


Robert LeBlanc <rjl@renaissoft.com>
Renaissoft, Inc.
Maia Mailguard <http://www.renaissoft.com/maia/>

Hello Martin,

Friday, March 5, 2004, 1:02:42 PM, you wrote:

ML> One thing came to my mind today. When i read that some of you catch alot of
ML> spams everyday, are you people going through this mailbox everday day for
ML> FP's? I'm doing it, but i only recieve about 80-100 spams a day. Some of you
ML> may get several thousands every day.

Generally review all collected spam daily (sometimes let it build for 2-3
days). Sort alphabetically by subject, and then scan the list. 90%+ of
all spam is obvious by subject and/or by repetition. Takes me about 90
seconds to review 700 emails. Catch 2-3 FPs a month.

Bob Menschel

On 5 Mar 2004 Robert LeBlanc (rjl@renaissoft.com) wrote:
> What I advocate is letting the end users control their content filtering
> settings and manage their own quarantines.

I agree with Robert that it is essential to your sanity to let
users look for their own FPs. I do this with various levels of
"yellow" and "red" IMAP-accessible mailboxes and having the spam
score injected into the beginning of the subject so that a
sorted-by-subject mailbox is in fact a sorted-by-spam-score
mailbox. I have some details about what I do here:

<http://www.ii.com/internet/messaging/spam/#SA>

Hope this helps,
Nancy

--
Nancy McGough
Infinite Ink ~ <http://www.ii.com>
Deflexion & Reflexion ~ <http://deflexion.com>