Re: [tlug] TLUG spam?

["Stephen J. Turnbull" <stephen@example.com>]

>>>>> "Shawn" == Shawn  <javajunkie@example.com> writes:

    Shawn> What about razor (working in conjunction with spamassassin) --

Razor can help, but as far as I can tell it's open to abuse by a
determined saboteur.  Anything automatic is.  And there are cruder DoS
attacks, ie, on the Razor servers themselves, and/or on the DNS.  I
don't think the spammers will allow Razor to survive if it seems to be
a real threat, ie, if a lot of sites are using it.

Also, it's "signature-based", and at least some of those signatures
are sensitive to random information like quoting.  So it must be
somewhat stupid about computing signature hashes.

The only way to beat that is to go "AI", and assess spamminess and/or
topicality of content.  Which is what I said in the first place.

And, of course, if it gets really successful, they may very well
decide to charge for access.  Or if a couple of big list servers cause
congestion on the Razor server, they may just blacklist them.  Isn't
that just spatial?  See

http://razor.sourceforge.net/docs/doc.php?type=text&name=SERVICE_POLICY

In the short run, yes.  Razor is going to work pretty well, especially
in combination with other methods, eg, SpamAssassin.  But I'd want a
good local backup in Razor decides to go away for any reason.

    Shawn> Too much of a risk -- need to open 2703 (Razor2) and TCP
    Shawn> port 7 (Echo)? Too slow?

There are practical considerations, too.  By far not everybody has a
choice about firewall policy.

Also, some people I trust to know what they're doing guesstimate that
all network-based checks are expensive in bandwidth.  XEmacs's host
doesn't use either RBL or Razor, to conserve on bandwidth.  They've
never actually tried either in the production mail pipeline, though,
so it _is_ just a guess.


-- 
Institute of Policy and Planning Sciences     http://turnbull.sk.tsukuba.ac.jp
University of Tsukuba                    Tennodai 1-1-1 Tsukuba 305-8573 JAPAN
               Ask not how you can "do" free software business;
              ask what your business can "do for" free software.