At 15:14 2005-11-17 +0100, Ruud H.G. van Tol wrote:
R.G. Ball:
Ach! Stay away from spam stuff. It is too much of a moving target and
is much better handled by specialized tools (even if those tools are
written in procmail). As several people have pointed out, very
effective spam filters can be created using some smart scoring of the
headers without ever looking at the body.
Yes, but a next step is the URLs in the body. I use procmail also to
report 'fresh' spam to SpamCop, and the least handwork involved the
better.
Er, the only spam which MIGHT possibly be a candidate for automated
reporting is stuff sent to spamtrap addresses, and with all the malware out
there that harvests email addresses and sends stuff out FROM: these
addresses, all it takes is some cluebie sending a reply to some spam
message ("please don't send this stuff to me. Thanx." <g>) to get legit
people sending messages to spamtraps. Thus, there's no really legit
automated reporting mechanism which can be relied upon to NOT report
non-spam. Even if you use a high SA scoring only, what is the assurance
that it isn't someone REPORTING a spam incident? My own spam filters have
a bypass when the message contains a subject line marker used in the abuse
reports I send out, else the sample included in the report might flag a
message.
(admittedly, I don't sent a lot of abuse reports these days - excepting in
response to joe-jobbing and the like).
---
Sean B. Straw / Professional Software Engineering
Procmail disclaimer: <http://www.professional.org/procmail/disclaimer.html>
Please DO NOT carbon me on list replies. I'll get my copy from the list.
____________________________________________________________
procmail mailing list Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail