Re: Is running spamassin on a home server a waste? (was ... Re: TCP/IP over Bluetooth)

[John Hasler]

I wrote:
> My scripts copy all new non-spam to a ham directory which is fed to
> sa-learn every night and then the contents of both the ham and the
> spam directories are deleted.

cbannister writes:
> IIRC, it seems pointless feeding your mail through a spam filter
> if you're downloading it from your ISP/email provider.

Newsguy does the usual SMTP-time stuff and has effective filters: they
probably catch ten times as much stuff as I see with my filters turned
off.  However their filters are not individualized and I doubt that I
would be satisfied with a system intended for the below-average user
even if they were.  My filters are down right now because my server died
and I'm seeing twenty or thirty spams a day.  When I replace the server
and get Spamassassin retrained I will se an average of less than one.
-- 
John Hasler 
jhas...@newsguy.com
Elmwood, WI USA

Re: Is running spamassin on a home server a waste? (was ... Re: TCP/IP over Bluetooth)

[Gene Heskett]

On Wednesday 27 April 2016 04:31:17 cbannis...@slingshot.co.nz wrote:

> On Sat, Apr 23, 2016 at 12:57:08PM -0500, John Hasler wrote:
> > > Thanks for making me think of that and the fact that over the last
> > > 10 years, the only ham its seen are its mistakes. So this question
> > > might have had the seeds of something to help. :)
> >
> > My scripts copy all new non-spam to a ham directory which is fed to
> > sa-learn every night and then the contents of both the ham and the
> > spam directories are deleted.
>
> IIRC, it seems pointless feeding your mail through a spam filter
> if you're downloading it from your ISP/email provider.

One of the two mail servers I use is an ancient qmail setup that dates 
from around 1998, and spam filtering is not its strong point. So 
spamassassin catches about 40 a day, and I feed about that many to 
sa-learn manually.  Jim tells me that qmail's filters do stop around 
20,000 a day according to its logs.  Also, of the 100 incoming ports, a 
mail will time out and be bounced by the sender because the spammers 
will open a port and forget to close it, so its out of incoming ports 
about 50% of the day.  A whole new machine has been built, around 
sendmail I think, with quite a bit more iron, but he has a vacation week 
coming up and is not about to make the changeover and leave for a week.

Cheers, Gene Heskett
-- 
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page 

Re: Is running spamassin on a home server a waste? (was ... Re: TCP/IP over Bluetooth)

[Brian]

On Wed 27 Apr 2016 at 11:14:15 +0200, to...@tuxteam.de wrote:

> On Wed, Apr 27, 2016 at 09:53:31AM +0100, Brian wrote:
> > On Wed 27 Apr 2016 at 20:31:17 +1200, cbannis...@slingshot.co.nz wrote:
> > 
> > > On Sat, Apr 23, 2016 at 12:57:08PM -0500, John Hasler wrote:
> > > > > Thanks for making me think of that and the fact that over the last 10
> > > > > years, the only ham its seen are its mistakes. So this question might
> > > > > have had the seeds of something to help. :)
> > > > 
> > > > My scripts copy all new non-spam to a ham directory which is fed to
> > > > sa-learn every night and then the contents of both the ham and the
> > > > spam directories are deleted.
> > > 
> > > IIRC, it seems pointless feeding your mail through a spam filter
> > > if you're downloading it from your ISP/email provider.
> > 
> > I think you are assuming the ISP provides a spam filtering service and
> > you are happy to entrust the deletion of your mail to it.
> 
> There is still some truth to the above:
> 
> The most effective measure against spam these days is rejecting
> the mail up front (i.e. while the SMTP session is active). This
> way a (hopefully rare!) false positive is rejected in a way the
> sender can act on it.

I'd agree with this but would suggest the (vast) majority of users have
their mail delivered to a POP3 or IMAP account. Any rejection at SMTP
time is left up to the ISP and a user is usually unaware of this or has
no control over it.

> Once you got the mail it's too late. Either you have to generate
> a bounce (not a good idea these days, because real spam will have
> bogus headers and the bounce will hit a poor unsuspecting victim),
> or you have to look into the spam anyway, or the spam disappears
> in a black hole (again not a good idea, since in the false
> positive case the sender will newer know).
> 
> Therefore once your ISP has accepted the mail for you it's kinda
> "too late" -- they better have a good spam filtering setup in
> which you have some influence (the spam filter will only work
> if it has a notion of what *you* consider to be spam/ham).

Indeed, the transaction is complete and the mail delivered once the ISP
accepts it. All a user can do is try to avoid downloading unwanted mail.
Leaving filtering to the ISP is fraught as many offer only a "take it or
leave it" service, again with no user control. Even more do not allow an
opt-out and no matter what the quality of the service a deleted mail is
a deleted mail. I'd rather make my own mistakes. And have. :)

Re: Is running spamassin on a home server a waste? (was ... Re: TCP/IP over Bluetooth)

[Hans]

Hi list,

I am running spamassassin in kmail. As I got several spam from my provider 
although there is a spamfilter active, I trained my own spamfilter very well.

There are no false positives or negatives since many years. 

However, some spammails still appear (about 2-3 a week), but this is no 
problem and I use them to train my spamfilter better and better.

All Spam will be moved into the wastepaperfolder (or whatever that thing is 
called).

Of course, a spamfilter is best set at the receiving mailserver, but I made the 
experience, that all spamfilters from the mailproviders are low quality. I 
suppose, these are all commercial products, and we all know, what quality 
commercial products have, do we?

Hope this helps a little bit.

Best regards

Hans

Re: Is running spamassin on a home server a waste? (was ... Re: TCP/IP over Bluetooth)

[tomas]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Wed, Apr 27, 2016 at 09:53:31AM +0100, Brian wrote:
> On Wed 27 Apr 2016 at 20:31:17 +1200, cbannis...@slingshot.co.nz wrote:
> 
> > On Sat, Apr 23, 2016 at 12:57:08PM -0500, John Hasler wrote:
> > > > Thanks for making me think of that and the fact that over the last 10
> > > > years, the only ham its seen are its mistakes. So this question might
> > > > have had the seeds of something to help. :)
> > > 
> > > My scripts copy all new non-spam to a ham directory which is fed to
> > > sa-learn every night and then the contents of both the ham and the
> > > spam directories are deleted.
> > 
> > IIRC, it seems pointless feeding your mail through a spam filter
> > if you're downloading it from your ISP/email provider.
> 
> I think you are assuming the ISP provides a spam filtering service and
> you are happy to entrust the deletion of your mail to it.

There is still some truth to the above:

The most effective measure against spam these days is rejecting
the mail up front (i.e. while the SMTP session is active). This
way a (hopefully rare!) false positive is rejected in a way the
sender can act on it.

Once you got the mail it's too late. Either you have to generate
a bounce (not a good idea these days, because real spam will have
bogus headers and the bounce will hit a poor unsuspecting victim),
or you have to look into the spam anyway, or the spam disappears
in a black hole (again not a good idea, since in the false
positive case the sender will newer know).

Therefore once your ISP has accepted the mail for you it's kinda
"too late" -- they better have a good spam filtering setup in
which you have some influence (the spam filter will only work
if it has a notion of what *you* consider to be spam/ham).

regards
- -- t
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlcggucACgkQBcgs9XrR2kZ1ogCfeTi3TQaPGTu14RAC2ShE8A7u
WuIAmwQ39ELaXqqqfMxlov5kIa4uMW0y
=t67R
-END PGP SIGNATURE-

Re: Is running spamassin on a home server a waste? (was ... Re: TCP/IP over Bluetooth)

[Brian]

On Wed 27 Apr 2016 at 20:31:17 +1200, cbannis...@slingshot.co.nz wrote:

> On Sat, Apr 23, 2016 at 12:57:08PM -0500, John Hasler wrote:
> > > Thanks for making me think of that and the fact that over the last 10
> > > years, the only ham its seen are its mistakes. So this question might
> > > have had the seeds of something to help. :)
> > 
> > My scripts copy all new non-spam to a ham directory which is fed to
> > sa-learn every night and then the contents of both the ham and the
> > spam directories are deleted.
> 
> IIRC, it seems pointless feeding your mail through a spam filter
> if you're downloading it from your ISP/email provider.

I think you are assuming the ISP provides a spam filtering service and
you are happy to entrust the deletion of your mail to it.