Re: [tlug] antispam tricks

[Al Hoang <hoanga@example.com>]

On Thu, Nov 16, 2006 at 06:51:43AM +0900, Josh Glover wrote:
> On 16/11/06, Botond Botyanszki <tlug@example.com> wrote:
> 
> > * I thought of using greylisting, but I think eventually spammers will
> >  lean towards becoming rfc compliant and come back later with the mail.

	I implemented greylisting on my SMTP server WITHOUT any spam
tagging tools and I can tell you it had dropped my spam from around 100
a day to a few a week.  The recent increase I'm now seeing 2-3 a day
which is making me consider implementing spamassassin as well to tag
what comes through.

	However, I really think it is flawed to think throwing your eggs
all in one basket will also beat the odds.  While statistical analysis 
will catch up with the spammers eventually there's this period of time 
when the spammers develop a new technique that requires a learning process.
During this time you will see an influx and you can't do much about unless
you get more similar candidates to train your spam filters again.

	I really think, it'll require a combination of technologies to keep
spammers out effectively if you want to see close to zero but for my own
purposes.  I can put up with 2 or 3 a day.  I don't like it but it's
better than 100.

	One last thought on why I think implementing greylisting is a good
idea is that it is cheap on processor time for you.  Greylisting hasn't
really upped CPU usage in a big way on my machine at home and that I'm
really happy about.

> 
> Why? Remember, spammers are all about efficiency. 
[snip]
> It is the same theory as Internet security; I am not so naive that I
[snip]
> At some point, you are right; spammers will probably deal with
> greylisting. But greylisting is unique, in that it costs the spammers
	Amen.  Make them pay and the number will drop down.

> 
> I was not a greylisting believer two years ago when I first read the
> paper. I am not, mainly thanks to the dramatic decrease in spam that I
              now
              ^^^

	I could be wrong, you might still be a non-believer but I
just need to be pendantic and sure :)

> have personally seen on the TLUG list:
> 
> With greylisting: average of 3 spams / day
> Without greylisting: average of 50 spams / day

	I see similar statistics on my machine at home.

Alain