James Wilkinson a écrit : > mouss wrote (about the PBL): >> stop spreading FUD. if you know of false positives, show us so that we >> see what you exactly mean. >> >> a lot of people, including $self, use the PBL at smtp time. > > As usual, it depends on your definition of “false positive”. >
fully agreed. I personally find it bad to block any "non spamming network". but sometimes, the only reasonable way to do this is via whitelists, and unfortunatley, you can't whitelist unknown senders. so yes, I do block some networks because I "think" they are too spammy (they may contain "legitimate" IPs). > If you mean “IP address that should not have been in the PBL but was”, > that’s one thing. It’s a consistent definition, but not very useful for > stopping spam. > > If you mean “solicited and/or non-bulk email that would have been > stopped by the PBL”, then I’ve seen a number of small Indian and Chinese > companies who are unaware of a lot of things, including the existence of > the PBL and that it’s a Good Thing to send email through a smart host > with a consistent IP address and reverse DNS.¹ > yes, the PBL may list blocks that contain networks which "want" to send mail directly, and which in principle, should be able to do so. but whatever decision you taéke here is difficult. if you say, I will only block those who I am certain are criminals, then some criminals will get in. whether you use them or not, lists that put some pressure on ISPs, networks, .. are good, and are necessary. some time ago, open relay was ok. now, you won't here much people saying "but I want the freedom to relay... ". yes, spammers are making us crazy ;-p > Obviously, everyone’s email stream is different. Mine includes a > commercially-significant amount of email from small companies in those > two countries, and probably doesn’t include email from other countries > where this takes place. > just to make things clear. while I do use zen, my setup is not what one would call aggressive (I do complain about some networks, but I don't block them. but I do block snowshoe spammers "too easily"). I do get "alien" mail from some networks (and not even from Asia!), and while I have thought of comibing checks (x AND y AND z), I found solicited mail that matches every bad thing I wanted to mix in the rule! > But by this definition, false positives do occur, and my company’s > SpamAssassin installation has to try to handle them. > > James. > > ¹ Fortunately, they’re also unaware that signatures should be removed > when replying. That, a standard corporate signature including company > registration data, a standard domain in each Message-ID that doesn’t > appear in public DNS, a few negatively-scored custom rules to detect > these, and the AWL mean that once someone has responded to one of our > emails, they get automatically whitelisted. So at least existing > correspondents don’t get blocked. >
