Hi all,
just a few explanations to the iXhash stuff:
First of all, sorry there were no installation instructions - I'll work
on that (Marc already added a few lines - thanks)
What the plugin does is the following:
- It works solely on the body of an email.
- Given a few minimum requirements are met a copy of the body is
stripped of superfluous information and a MD5 hash computed from the
rest. There are basically two differnet stripping algorithms (resulting
in two hashes), if none of them can be computed a simple hash of the
complete body will computed instead.
- The hashes are then checked via DNS . Normally there will be two
hashes, so you will have two seperate DNS requests. If you get a result
(127.0.0.2) this hash is identical to a know spam's hash and the mail
being tested is spam (for the plugin at least)
Obviously, Net::DNS and Digest::MD5 are required (and
Mail::SpamAssassin...)
The plugin is modeled after a procmail-based anti-spam project called
NiXSpam, published by the German IT magazine iX some while ago.The
hashes available in the manitu.net zone come from that source. The two
nospam.login-solutions.(de|ag)-zones are maintained by me.Especially the
.de zone has grown quite large and should give some results.
In the end you get another sort of fuzzy checksum-like network test
along the lines of razor, pyzor and DCC. The feedback I got so far is
that it actually helps detecting spam that would slip thru, esp.
image-only spam and the like.
There is no automatic (or semi-automatic) reporting of hashes atm.
Presumably never will...this is foremost a question of
computing/network/Gehirnschmalz ressources
Also, there is no 'confidence level'. one could add it using the
returned IP from the DNS to make the number of reported hashes somehow
visible, but I see little need to - there are close to now FPs, and the
one I did see were due to problems in the implementation on my side. In
other words, if you get a 127.0.0.1 returned, the plugin is 100% sure
it's spam.
I registered to project @ Sourceforge to offer CVS and the like, but as
I live in Munich, I don't see me uploading content as long as the World
Cup is on. Saturday I witnessed a Saudi-Arabian/Brazilian drumming
session at the Marienplatz .... - no, I'd rather not spend much time on
my PC!!
Dirk
