This reminds me very strongly of a filtering strategy I used years
ago, back when I still read Usenet newsgroups. There was this one
newsgroup, I forget, maybe sci.crypt? Most of the traffic in the
newsgroups was long chains of flames kicked off by one troller. A
killfile rule that blocked any message whose References or
Message-ID headers contained the kook's vanity domain name worked
wonders. Since you can't count on modern kooks being so kind as to
always post from unique vanity domains (so that their message-IDs
brand them) the problem is rather harder.
Sounds like the ideal solution would use a couple of helper
programs. You want one program that you use from your mail user
agent, you bind it to the kook button. It takes a message from
stdin, and grovels out the From:, and dumps that into a file of
known kooks. It also feeds the message to the kook-msg filter, which
adds the message-id to the list of known kook-thread-messageids.
Keep this as a plain text file, one line per message; use fgrep
from procmail to check messages to see if they are in kook chains,
and if so feed 'em to the kook-msg filter as well. Likewise, let
procmail fgrep against the known-kooks list to catch new threads.
I guess formail could probably do most of that, it's spiffy for
grovelling out header values:-).
Keep the kook and messageid lists in plain text files, with normal
line termination.
If you're really worried about size, rig a monthly cronjob that
checks, and if they've exceeded 10MB or something chops 'em back
down to say 8MB or whatever, perhaps by counting the lines (with "wc
-l"), taking 20% (*2/10 will do the deed with awk), then using tail
to skip forward that far. Dump to tmp file, mv over original file.
This isn't guaranteed safe in the face of concurrent email delivery,
but since mv is atomic, and so is the append operation, I can't see
any danger worse than a remote chance of missing a messageid. No big
deal.
-Bennett
pgpe4YRuV8Rgh.pgp
Description: PGP signature