[cobalt-users] Re: Dealing with SPAM - has anyone tried this file?

[Charlie Summers <charlie@xxxxxxxxxx>]

At 5:30 PM -0400 8/3/01, Carrie Bartkowiak is rumored to have typed:

> Discovering the truth about ORBS really made me wary
> about that.

   Um, I don't know what "truth" you "discovered," but it's been _long_ known
that there were problems with the stability of the maintainer of the ORBS
list, which is why many of us chose not to use it. The miracle is not that
ORBS got closed down, the miracle is that it took so long.

> I'm thinking about constructing a set of procmail rules that will
> look for common spam message phrases in the subject line - any
> suggestions?

   Of course, by the time procmail gets the message, it's already been
delivered to your machine. Using ordb.org, orbz.org, or other son-of-ORBS
directly from sendmail, your machine doesn't even _receive_ the mail from
open-relay machines (sendmail closes the connection before the DATA phase).
And the list Scott is talking about using is static, which means he would
need to manually re-load the list anytime there was an update to it (even one
machine)...although at least the access list would close the connection from
listed machines, a static list requires too much user maintenance to be
useful.

   procmail is excellent for a whole lot of uses (like removing the
unnecessary Subject: and Reply-To: munges added to this list, for example),
but it makes a relatively lousy anti-spam tool since it is reactive instead
of proactive, and dropping to /dev/null doesn't give the inevitable
false-positives any feedback to know their message has been unseen.

   Find a DNS blacklist with a philosophy to which you can agree, and use
it...certainly I can no longer recommend MAPS after their decision to force
users to sign draconian contracts and pay use-based fees, but there are quite
a few non-commercial DNS bl's out there from which to choose.

   (Apologies to the list for the off-topic nature of this posting; please
feel free to contact me OFF-list should you wish to continue the discussion.
Unless your relay is open, of course...  ;)

         Charlie