Re: [Mimedefang] Another silly idea

2006-05-05 Thread Steffen Kaiser
On Thu, 4 May 2006, John Rudd wrote: John, thanks! This advice seems to overcome my problem. -- Steffen Kaiser ___ NOTE: If there is a disclaimer or other legal boilerplate in the above message, it is NULL AND VOID. You may ignore it. Visit

RE: [Mimedefang] Another silly idea

2006-05-05 Thread Steffen Kaiser
On Thu, 4 May 2006, Les Mikesell wrote: There's always gmail.com which you can set up for pop retrieval and authenticated smtps sending. And the price is right. Ah, SMTP is hidden in the help center, one has to search for SMTP there. Well, I have to check out Gmail, too. Thanks for the

RE: [Mimedefang] Another silly idea

2006-05-04 Thread Steffen Kaiser
On Wed, 3 May 2006, Jeff Rife wrote: If my ISP mail server allowed me to use my domain as a return address in e-mail that is passed through it, this would be a good solution. It doesn't, and neither do most ISPs. So, you'll never get my e-mail, but Well, guys, I have to apologise for

Re: [Mimedefang] Another silly idea

2006-05-04 Thread WBrown
Martin Blapp wrote on 05/03/2006 05:27:55 PM: Do you mean something like: http://antispam.imp.ch/03-wormlist.html?lng=1 Exactly. I saw the comments in your other message about it being regional. How are you collecting the data? Is it only systems that have sent to your server(s)? Do you

RE: [Mimedefang] Another silly idea

2006-05-04 Thread Les Mikesell
On Thu, 2006-05-04 at 06:22, Steffen Kaiser wrote: But this is my problem, too - and the problem of many others in my local area: + The (mail) providers either: 1) don't allow SMTP/POP/IMAP, but web only, or 2) mangle the From header (well, one even placed the telephone number there

Re: [Mimedefang] Another silly idea

2006-05-04 Thread Martin Blapp
Hi, regional. How are you collecting the data? Is it only systems that have The data are updated in realtime per ns-update from about 8 different ISPs. sent to your server(s)? Do you age systems out of the RBL after three days? Yes, each night there is a script running which removes

Re: [Mimedefang] Another silly idea

2006-05-04 Thread John Rudd
On May 4, 2006, at 4:22, Steffen Kaiser wrote: On Wed, 3 May 2006, Jeff Rife wrote: If my ISP mail server allowed me to use my domain as a return address in e-mail that is passed through it, this would be a good solution. It doesn't, and neither do most ISPs. So, you'll never get my

RE: [Mimedefang] Another silly idea

2006-05-03 Thread Steffen Kaiser
On Tue, 2 May 2006, Paul Murphy wrote: Question 2: to what extent is your incoming spam volume generated by dynamic addresses, dial-up systems, broadband hosts, and other end-user systems which either have their IP address in their hostname (e.g. 220x218x25x21.ap220.ftth.ucom.ne.jp) or which

Re: [Mimedefang] Another silly idea

2006-05-03 Thread John Rudd
On May 3, 2006, at 12:13 AM, Steffen Kaiser wrote: I hate this banning of dynamic addresses right away. Sure, there is no (at least not known to me) way to know, whether the host with a dynamic address is an badly or well configured end-user system, That's actually not the issue for me.

RE: [Mimedefang] Another silly idea

2006-05-03 Thread Paul Murphy
I hate this banning of dynamic addresses right away. Sure, there is no (at least not known to me) way to know, whether the host with a dynamic address is an badly or well configured end-user system If it has no reverse DNS and no MX records, it is a badly configured end-user system.

Re: [Mimedefang] Another silly idea

2006-05-03 Thread Jack Olszewski
From: Paul Murphy [EMAIL PROTECTED] Subject: RE: [Mimedefang] Another silly idea Date: Wed, 3 May 2006 10:19:31 +0100 pjm ... pjm if ( $hostname =~ /dsl./i ) pjm { pjm md_syslog(info,$MsgID - Host $hostname is a DSL broadband client); pjm return (0); pjm } pjm ... So, you

RE: [Mimedefang] Another silly idea

2006-05-03 Thread Paul Murphy
pjm ... pjm if ( $hostname =~ /dsl./i ) pjm { pjm md_syslog(info,$MsgID - Host $hostname is a DSL broadband client); pjm return (0); pjm } pjm ... So, you are rejecting messages from eg. mail.redslab.com that may be a perfectly legitimate and well behaving mail

Detecting hosts with dynamic addresses (was Re: [Mimedefang] Another silly idea)

2006-05-03 Thread David F. Skoll
For what it's worth, this is my code to detect a likely-looking dynamic IP address, based on the PTR record. I won't explain how it works; I'll leave that up to the readers. :-) It catches all host names that have either the IP address or reversed IP address somehow embedded in them. For

Re: [Mimedefang] Another silly idea

2006-05-03 Thread WBrown
[EMAIL PROTECTED] wrote on 05/03/2006 02:56:40 AM: Well, there is yet another possibility: The AV software the ISP is running did simply not detected that particular malware. Granted. Perhaps detecting when they first send that virus and allowing them 2 hours to get new defs before

RE: [Mimedefang] Another silly idea

2006-05-03 Thread WBrown
[EMAIL PROTECTED] wrote on 05/03/2006 05:19:31 AM: Effectively, a certificate system would be the same as a whitelist - the owner of the system has to take action to have it recognised as a valid mail server. Sounds like SPF... Owner taking action... to register SPF record. Some now

[ot] rant about changing ISPs being ludicrous Re: [Mimedefang] Another silly idea

2006-05-03 Thread Kevin A. McGrail
David, with all due respect, you are living in a utopia because your suggestion is not feasible where I live and work. I must agree with WBrown. I live in the Metropolitan D.C. area within a few miles of MAE East, MCI and AOL's HQ's. I've got a wide choice of Tier 1 companies and technologies

RE: [ot] rant about changing ISPs being ludicrous Re: [Mimedefang]Another silly idea

2006-05-03 Thread Paul Murphy
Note that the original topic was regarding dynamic IP addresses, and it was in the context of a small home or hobbyist user that I recommended voting with your wallet. Obviously, for major connections, the hassle is extreme. Also for major connections, I would expect them to provide a

Re: [Mimedefang] Another silly idea

2006-05-03 Thread Paul Whittney
Adelphia cable doesn't. In fact, half of them didn't know what I was talking about, but the others came back with a We've never done that for customers. So, based on the code flying around, you'd never get my email. So what would your response be (I usually try to reject with a telephone number,

Re: [Mimedefang] Another silly idea

2006-05-03 Thread Ben Kamen
The one thing that comes to mind with us in the US needing to enter the age of technology: Don't tell us that - we know. The problem is the ISP's want the dumbest people they can find to maximize their investment of their company. That means 99% of the folks of the engineering staff typically

Re: [Mimedefang] Another silly idea

2006-05-03 Thread Matthew Schumacher
Ben Kamen wrote: Don't tell us that - we know. The problem is the ISP's want the dumbest people they can find to maximize their investment of their company. That means 99% of the folks of the engineering staff typically can't even SPELL D-N-S, let alone use a program like 'vi'. Holy

RE: [ot] rant about changing ISPs being ludicrous Re: [Mimedefang]Another silly idea

2006-05-03 Thread WBrown
[EMAIL PROTECTED] wrote on 05/03/2006 11:48:16 AM: You guys in the States need to embrace the world of technology ;-) But if you listen to our politicians, we're leading the world when it comes to technology. Hell, even China has better penetration of high speed internet than the US does in

Re: [Mimedefang] Another silly idea

2006-05-03 Thread John Rudd
(this is going a little off topic ... but ... ) On May 3, 2006, at 9:19 AM, Ben Kamen wrote: I had a problem with my DSL line from SBC When I moved from Santa Cruz to San Jose, I found out my new house wasn't going to be within the Covad area of coverage ... so I'd have to leave

Re: [Mimedefang] Another silly idea

2006-05-03 Thread Ben Kamen
Matthew Schumacher wrote: Anyway, some ISPs have good people on staff, I think the bigger problem is management limiting the authority of people that really know how to get the job done. My $.02 In Fairness, I would agree that there's probably an ISP or two out there with some people on

Re: [Mimedefang] Another silly idea

2006-05-03 Thread Martin Blapp
Hi, Do you mean something like: http://antispam.imp.ch/03-wormlist.html?lng=1 Martin ___ NOTE: If there is a disclaimer or other legal boilerplate in the above message, it is NULL AND VOID. You may ignore it. Visit http://www.mimedefang.org and

Re: [Mimedefang] Another silly idea

2006-05-03 Thread Ben Kamen
Martin Blapp wrote: Hi, Do you mean something like: http://antispam.imp.ch/03-wormlist.html?lng=1 Is anyone using this list with success? I'd like to know.. Also their config line for sendmail has an error... FEATURE(`enhdnsbl', `wormrbl.imp.ch', `451 tempfail - see

Re: [Mimedefang] Another silly idea

2006-05-03 Thread Jeff Rife
On 3 May 2006 at 10:33, David F. Skoll wrote: Congratulations. You have an ISP that will configure that for you. Not all will for any amount of money. In most places, you can switch ISPs if the one you're using is not giving good service. I realize there are some places with virtual

RE: [Mimedefang] Another silly idea

2006-05-03 Thread Jeff Rife
On 3 May 2006 at 17:26, Paul Murphy wrote: So, based on the code flying around, you'd never get my email. So what would your response be (I usually try to reject with a telephone number, so real clients can phone and bitch about the SMTP failure)? Change ISP... That's not quite the

Re: [Mimedefang] Another silly idea

2006-05-03 Thread Martin Blapp
Hi, Is anyone using this list with success? Yes, some ISPs in europe do. As you can see, the listed IPs belong to europe ISPs mostly. The problem is that the data sources aren't mixed with global players. Virus and worm statistics seem always to be local based - in contrary to spam

[Mimedefang] Another silly idea

2006-05-02 Thread WBrown
Since my last idea got shot down pretty thoroughly, I though I'd float another idea past the list. :) Since a large volume of spam is sent by machines that have been compromised, frequently by virii, is there any reason to trust a sender that has been seen sending virii in the recent past.

Re: [Mimedefang] Another silly idea

2006-05-02 Thread David F. Skoll
[EMAIL PROTECTED] wrote: Since a large volume of spam is sent by machines that have been compromised, frequently by virii, is there any reason to trust a sender that has been seen sending virii in the recent past. Probably not. Such a blacklist is probably a good idea, but doesn't it

Re: [Mimedefang] Another silly idea

2006-05-02 Thread Craig Green
[EMAIL PROTECTED] wrote: My thinking is why not add them to an RBL if they have sent a virus in the past week or two, [munch] Even if it is a legitmate mail server, I cannot think of any reason to trust it if it does not have functioning antivirus software running. I tried this. Turns

Re: [Mimedefang] Another silly idea

2006-05-02 Thread WBrown
[EMAIL PROTECTED] wrote on 05/02/2006 12:11:00 PM: I tried this. Turns out a shocking number of ISPs and businesses don't bother running AV software on their outbound servers and just blindly relay their users' mail. If you run the BL locally and no one knows about it. If it's a publicly

Re: [Mimedefang] Another silly idea

2006-05-02 Thread Kelson
Craig Green wrote: I tried this. Turns out a shocking number of ISPs and businesses don't bother running AV software on their outbound servers and just blindly relay their users' mail. We got around this by only blacklisting virus senders under the following conditions: 1. The IP sent a