Thanks William, Eric, and others. I've returned late to list sorry to jump into it but thanks for the links. One could easily put a pix 501 or similar hardware inline with the imail email server / imgate machines to manually control an ACL list. I for one am going to try to implement a simpler solution by implementing the pkfiltering software solution via http://www.famhost.com/support/pktfilter.zip The folks in France did a nice job with it. Maybe I could just use perl to update a static ACL list in a sort of dynamic way.. lol
~Rick -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of William Van Hefner Sent: Saturday, September 06, 2003 7:19 AM To: [EMAIL PROTECTED] Subject: RE: [IMail Forum] Teaching the bayes engine with RBL mails Eric, Those lists are exactly the same type that I am using, only they are managed by a different blacklist server. It sounds like he wants to completely block ALL traffic from these countries "at the border routers". Am not sure if he is talking about a router that just covers his e-mail servers, or his entire network, but the latter would indeed be pretty extreme, as it would block anyone from those countries from viewing any of his websites, either. As long as you do not mind the possibility of the list being slightly out of date, and are willing to update it on a regular basis, there are text files available for each country that you can manually import into the hosts file of your DNS server or Imail machine. That would cut down on the amount of time needed for lookups, for sure. You would just have to remember to update the IPs on a regular basis to make sure you were not blocking anything legit. Fortunately, these IP addresses change far less frequently than that of most spammers. Some of the country specific lists can be found at http://www.blackholes.us . They can simply be downloaded as a text file, or you can use them as a traditional real-time blacklist by using their servers. I do it that way myself, but it does put more of a load on the Imail server and slow delivery of mail slightly, at the expense of having the list up-to-date in real time. William Van Hefner System Administrator TheDigest.Com/TelCompare.Com > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Eric Shanbrom > (Ipswitch) > Sent: Saturday, September 06, 2003 4:54 AM > To: [EMAIL PROTECTED] > Subject: Re: [IMail Forum] Teaching the bayes engine with RBL mails > > > How about this Rick? > > http://support.ipswitch.com/kb/IM-20030512-DM07.htm > > Will this do for ya? > > Eric S > ----- Original Message ----- > From: "Rick Klinge" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Saturday, September 06, 2003 5:02 AM > Subject: RE: [IMail Forum] Teaching the bayes engine with RBL mails > > > > Hmm.. good points.. but why not just block the ip address > and/or range and > > not even worry about the extra server load, admin time, and 99.999% > garbage > > anyway? I've been trying to find an adequate - up to date - > tld list, or > > something, via country in order to ban the whole class A.. that'll make > some > > of you squirm in your seats I'm sure.. but my point is if we > are receiving > > 99.9x spam/porn/worms/viruses/trojans/hackers/etc from say > netherlands or > > china, and none of our customers want/need to receive junk from > them, then > > we elect to block them 'at the border routers'. > > I could not imagine having to pay a 40+ hour employee 'just to police > > garbage'.. but I guess some of you do.. > > > > Just a though, > > > > ~Rick > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] Behalf Of William Van > > Hefner > > Sent: Saturday, September 06, 2003 2:45 AM > > To: [EMAIL PROTECTED] > > Subject: RE: [IMail Forum] Teaching the bayes engine with RBL mails > > > > > > Scott, > > > > Hmm... I hadn't even noticed that SPAM is in a different case > than spam. I > > only typed it in lower case to begin with out of laziness. :-) > > > > You are absolutely right about deleting first and asking questions later > > being a poor method of spam control. That is not only closing the barn > door > > after the horse has been let out, but is potentially throwing > out the baby > > with the bathwater. O.k., enough metaphors! > > > > My best advice to anyone is to TEST, TEST, TEST before you even think of > > sending anything to NUL. Always err on the side of caution with the > > blackhole lists, since they are just the first line of defense. Although > > very important, they are only the beginning of many tests you > can perform > > with Imail. We both believe in weighting systems of some sort. Mine is > just > > a little cruder and more time consuming. However, I strongly > feel that NO > > Baysean filtering, artificial intelligence, single blacklist, > or weighting > > system will ever be as accurate as real, human monitoring of e-mail. A > > computer may now be able to beat the best chess player in the world, but > it > > still can not more accurately tell what is spam and what is not better > than > > a human being can. In particular, I have seen Imail tag mailings from a > > commercial list I subscribe to over and over again as spam, when it > clearly > > is not. In fact, it gives it a 1.00 probability! I hope that > Ipswitch will > > one day be able to extend Baysean filtering on a per-user basis, as that > is > > the only way that accuracy will ever approach the 99%+ legitimacy rate > that > > is possible with that technology. > > > > > > William Van Hefner > > System Administrator > > TheDigest.Com/TelCompare.Com > > > > > > > > > -----Original Message----- > > > From: [EMAIL PROTECTED] > > > [mailto:[EMAIL PROTECTED] Behalf Of R. > Scott Perry > > > Sent: Friday, September 05, 2003 10:51 AM > > > To: [EMAIL PROTECTED] > > > Subject: RE: [IMail Forum] Teaching the bayes engine with RBL mails > > > > > > > > > > > > >Thanks for the tip about not using "RBL" to refer to generic > real-time > > > >blackhole lists. I had no clue that MAPS went so far as to trademark > it. > > > > > > They trademarked it first. :) MAPS named their service > "RBL", and then > > > people started to use the term generically (like Kleenex, > Xerox, etc.). > > > > > > >Why is it o.k. to constantly refer to unsolicited commercial > e-mail as > > > >spam then > > > >though? :-) > > > > > > Actually, there's a good reason -- Hormel doesn't mind people > using the > > > term "spam", because their trademark is in all capitals ("SPAM"). > > > If I see > > > people use "SPAM" too much to refer to spam, I point that out too. :) > > > > > > >BTW, it was ME who "claimed" to have no false positives. > Specifically, > I > > > >claimed to have no false positives during the entire month that > > > I tested the > > > >configuration and manually (yes, manually) sorted through > every single > > > >X-IMAIL tagged e-mail from all of our domains to determine if > > > there was ANY > > > >legitimate e-mail being caught by three or more blacklists. > > > There were none. > > > > > > Great. That's exactly how you should look for false positives. > > > I thought > > > that you were calculating it based on how many people complained about > > > E-mail getting caught (which isn't the correct way to calculate it). > > > > > > -Scott > > > --- > > > Declude JunkMail: The advanced anti-spam solution for IMail > mailservers. > > > Declude Virus: Catches known viruses and is the leader in mailserver > > > vulnerability detection. > > > Find out what you have been missing: Ask for a free 30-day evaluation. > > > > > > --- > > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > ___________________________________________________________________ > Virus Scanned and Filtered by http://www.FamHost.com E-Mail System. > > > ___________________________________________________________________ > Virus Scanned and Filtered by http://www.FamHost.com E-Mail System. > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ ___________________________________________________________________ Virus Scanned and Filtered by http://www.FamHost.com E-Mail System. ___________________________________________________________________ Virus Scanned and Filtered by http://www.FamHost.com E-Mail System. To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
