Re: [Mimedefang] Spam ethics question

2010-01-14 Thread Ben Kamen
I've been using spampoison.com of late. Kinda makes me laugh. -Ben -- Ben Kamen - O.D.T., S.P. = Email: bkamen AT benjammin DOT net Web: http://www.benjammin.net __

Re: [Mimedefang] Spam ethics question

2010-01-14 Thread -
--- On Thu, 1/14/10, Ben Kamen wrote: > I had that for a bit where my low priority MX host was routed to self > and SBC (Ameritech) used to reject any email from as their servers > knew the seconday/low-priority route was bogus. OK, but I'm not suggesting its use on a live host (or domain). I'm

Re: [Mimedefang] Spam ethics question

2010-01-14 Thread Ben Kamen
On 1/14/2010 4:12 PM, - wrote: I had that for a bit where my low priority MX host was routed to self and SBC (Ameritech) used to reject any email from as their servers knew the seconday/low-priority route was bogus. Poo. -Ben -- Ben Kamen - O.D.T., S.P.

Re: [Mimedefang] Spam ethics question

2010-01-14 Thread -
Playing games with spammers is fun. You could always do something like this: DNS records: fake.hostname.example.com. IN MX 10 tarbaby.junkemailfilter.com. MX 20 mail.example.invalid. MX 30 localhost.

Re: [Mimedefang] Spam ethics question

2010-01-14 Thread Andrzej Adam Filip
wbr...@e1b.org wrote: > Kelson wrote on 01/14/2010 02:43:35 PM: > >> It's not the effect that's at issue, it's the process. >> >> The whole point of a honeypot is that you have a guarantee that no one >> has ever requested that mail go to that address, so any mail sent there >> is unsolicited by de

Re: [Mimedefang] Spam ethics question

2010-01-14 Thread WBrown
Kelson wrote on 01/14/2010 02:43:35 PM: > It's not the effect that's at issue, it's the process. > > The whole point of a honeypot is that you have a guarantee that no one > has ever requested that mail go to that address, so any mail sent there > is unsolicited by definition. > > If you subscribe

Re: [Mimedefang] Spam ethics question

2010-01-14 Thread Kelson
On 1/14/2010 10:05 AM, Andrzej Adam Filip wrote: "David F. Skoll" wrote: wbr...@e1b.org wrote: Why shouldn't I find some honey-pot addresses and submit submit them to subscribe? Because, IMO, that subverts the purpose of honeypots. A honeypot is designed as a passive spammer attractor; act

Re: [Mimedefang] Spam ethics question

2010-01-14 Thread Ben Kamen
On 1/14/2010 12:05 PM, Andrzej Adam Filip wrote: "David F. Skoll" wrote: wbr...@e1b.org wrote: Why shouldn't I find some honey-pot addresses and submit submit them to subscribe? Because, IMO, that subverts the purpose of honeypots. A honeypot is designed as a passive spammer attractor; act

Re: [Mimedefang] exe in defective zip attachments gettingthrough mimedefang

2010-01-14 Thread Cliff Hayes
Reference my last email ... I wasn't very clear. Here is the original code: sub re_match_in_zip_directory ($$) { my($zipname, $regexp) = @_; unless ($Features{"Archive::Zip"}) { md_syslog('err', "$MsgID: Attempted to use re_match_in_zip_directory, but Perl module Archive::Zip is no

Re: [Mimedefang] exe in defective zip attachments gettingthrough mimedefang

2010-01-14 Thread Dave O'Neill
On Thu, Jan 14, 2010 at 12:14:47PM -0600, Cliff Hayes wrote: Tried to send you 2 samples; got this error "550 5.1.1 ... User unknown" That's odd -- I can't find any delivery attempt in our logs. I did get your off-list reply telling me that you were about to send the samples, though. Were t

Re: [Mimedefang] Spam ethics question

2010-01-14 Thread WBrown
Andrzej Adam Filip wrote on 01/14/2010 01:05:49 PM: > But actively un-subscribing not subscribed email addresses is OK > => as far as I have heard the effect is almost identical :-) In many cases that's probably true. Upon further review of the headers, they are passing through mail outsourcer

Re: [Mimedefang] exe in defective zip attachments gettingthrough mimedefang

2010-01-14 Thread Cliff Hayes
Dave, Tried to send you 2 samples; got this error "550 5.1.1 ... User unknown" I checked the valuse of ->read() per your request. It is "3" which is "format error in the zip file" which is what I expected. Did some further checking and here are the possible values: AZ_OK (0) Everything is fine

Re: [Mimedefang] Spam ethics question

2010-01-14 Thread Andrzej Adam Filip
"David F. Skoll" wrote: > wbr...@e1b.org wrote: > >> Why shouldn't I find some honey-pot addresses and submit submit them to >> subscribe? > > Because, IMO, that subverts the purpose of honeypots. A honeypot > is designed as a passive spammer attractor; actively subscribing > someone is a no-no.

Re: [Mimedefang] exe in defective zip attachments gettingthrough mimedefang

2010-01-14 Thread Kevin A. McGrail
Actually this topic was covered a while back when there were RAR files masquerading as zip files. Here's a function I call from filter_bad_filename. I've modified my filter to handle a return of 1 as a bad file and 2 as a really bad file which outright blocks the email. sub filter_bad_filen

Re: [Mimedefang] exe in defective zip attachments getting through mimedefang

2010-01-14 Thread Dave O'Neill
On Thu, Jan 14, 2010 at 10:54:14AM -0600, Cliff Hayes wrote: if Archive::Zip doesn't return an AZ_OK then mimedefang lets the attachment through. From what I could find out, if Archive::Zip doesn't return AZ_OK then there is a problem with the zip file. I'd rather block defective zip files then

[Mimedefang] exe in defective zip attachments getting through mimedefang

2010-01-14 Thread Cliff Hayes
Hello, We're getting the standard UPS attachment scam. An exe is inside a zip file. Mimedefang catches most of these but it misses a few. I decided to track one of the few through mimedefang and found out why in mimedefang.pl if Archive::Zip doesn't return an AZ_OK then mimedefang lets the att

Re: [Mimedefang] Spam ethics question

2010-01-14 Thread David F. Skoll
wbr...@e1b.org wrote: Why shouldn't I find some honey-pot addresses and submit submit them to subscribe? Because, IMO, that subverts the purpose of honeypots. A honeypot is designed as a passive spammer attractor; actively subscribing someone is a no-no. Regards, David.

[Mimedefang] Spam ethics question

2010-01-14 Thread WBrown
I just got spammed by a company that claims on their website "We hate SPAM as much as you do." So why did they repeatedly send it to our abuse address? They also sent it to almost every school district we filter email for. To the best of my knowledge, none of them requested the email either. Ne