On 3/22/2011 2:31 PM, Adam Katz wrote:
On 3/22/2011 1:16 PM, Mark Chaney wrote:
Ever notice that a lot of spam seems to have your username in their
from address? Such as an email sent TO b...@domain.com is FROM
blah...@anotherdomain.com (notice 'blah' included in the from
address). This appears to be the case with a large a majority of
the spam that gets through my filters. Any ideas how to handle
this? Would be nice to be able to add a score for matches like
that.
This hasn't been common enough (in my experience) to justify either of
the two ways to match it (a plugin or else an ugly pair of multi-line
ALL header rules). I suppose somebody could throw something up in their
sandbox, but we'd need the result from timing.log (not published) to
properly gauge the results (assuming it even has a favorable hit rate
and S/O).
On 03/22/2011 01:59 PM, Ted Mittelstaedt wrote:
If this sort of thing bothers you then simply use a unique or close
to unique username and then put a filter in your e-mail client.
send mail from:
markymarkythefunkyd...@northpole.com
and your guaranteed that anyone mailing you with
"markymarkthefunkydude" in any part of their sending e-mail address
is a spammer, and it should be child's play to create a filter in
even Outlook that will delete those messages.
That's an ugly workaround that will serve to annoy anybody he
corresponds with (especially if he's dictating his address at a party;
that doesn't fit on a napkin). It also requires trashing an old email
address, which means alienating/losing old contacts.
Many corporations have gone to using full name separated by period
precisely to reduce spamload. And, how much loss is it to lose
an e-mail address like cooldude8675...@aol.com? Not to say that the
OP had that kind of an e-mail address but I can't count the number
of gmail.com, aol.com and hotmail.com addresses out there where the
user has a set of numerals tacked on to the name portion of their
e-mail address.
Believe it or not we actually have a few users who have listed ALL
of their contacts and delete ANY mail that is not in their contact
list. I can only presume they never attend the sort of parties that
you write your e-mail address on a napkin.
I can say that at our site there's a definite increase in spam to
short e-mail addresses (such as my own).
It also doesn't address the abstraction that Mark was trying to share
with us. The real question is: is this common in uncaught spam?
Unfortunately it is very common on this mailing list to make the claim
that "oh, that [insert special case here] isn't a problem because our
other filters are good enough to catch it" when the insert special case
is difficult to figure out how to program for.
But the fact is that we are approaching the area of diminishing returns
with the Spamassassin canned rulesets. Bays isn't that usable for many
sites and frankly I've only seen it successfully implemented when we
can get users to use IMAP since we can train them to drag the spams into
a junk folder that a script can then fish out and stuff into the learner.
You shouldn't be asking the question "how much uncaught spam does this
thing I think is an ugly hack would be good for"
You should be saying "well, it will probably only catch 2% of the
uncaught spam - but if I add this ugly hack to that other ugly hack to
that other ugly hack all of which only catch 2% of the uncaught spam -
why then guess what now I'm making a real dent in the stuff!!!"
The former attitude is "your problem is an annoyance to me and I'll
try to avoid it by studying it to death" the latter is "how can I help
you with your problem" attitude.
Just sayin!
And no, my comment on the attitude displayed is no indication that I
think a ruleset based on the OP's proposal would be viable or not.
Ted
