[pmmail-list] Spam Filtering - HOW?

Fri, 26 Sep 2003 12:06:24 -0400

On=20Fri,=2026=20Sep=202003=2005:39:15=20-0500=20(CDT),=20Maynard=20Riley=20=
wrote:

>Hi=20Ralph,
>
>As=20I=20hear=20it,=20you=20are=20essentially=20"whitelisting"=20first;=20=
and=20considering
>everything=20else=20to=20be=20junk;=20which=20is=20the=20proper=20techniq=
ue=20for
>firewalling,=20block=20everything=20and=20then=20open=20just=20the=20hole=
s=20required.
>

Hi=20Maynard,

That's=20essentially=20correct.=20=20However,=20like=20you,=20I=20also=20h=
ave=20a=20filter=20to
recognize=20junkmail=20that's=20extremely=20effective=20after=20everything=
=20else=20has
been=20filtered=20through=20the=20whitelist=20filters.=20=20Until=20recent=
ly,=20my=20setup
allowed=20anything=20that=20didn't=20get=20caught=20by=20my=20junkmail=20f=
ilter=20to=20be
sent=20to=20my=20inbox=20instead=20and=20I=20would=20deal=20with=20it=20th=
ere.=20=20A=20couple=20of
months=20ago=20I=20modified=20my=20setup=20slightly=20so=20that=20instead=20=
of=20being=20passed
on=20to=20my=20inbox,=20everything=20slipping=20past=20the=20whitelists=20=
and=20junk=20filter
gets=20sent=20to=20another=20holding=20folder.=20=20This=20makes=20it=20ev=
en=20easier=20to
determine=20if=20my=20whitelists=20or=20junk=20mail=20filters=20need=20to=20=
be=20modified=20and
the=20accuracy=20of=20filtering=20junkmail=20now=20hovers=20at=20around=20=
98-99%.=20=20What
that=20means=20for=20me,=20is=20that=20I=20could=20theoretically=20do=20aw=
ay=20with=20the=20junk
filter=20entirely=20and=20still=20filter=20out=20virtually=20all=20of=20it=
=20using
whitelists.

>It's=20an=20elegant=20solution=20of=20course,=20and=20I'm=20glad=20that=20=
it's=20working=20for
>you,=20but=20in=20my=20mail=20stream,=20my=20oldest=20email=20address=20w=
asn't=20carefully
>protected,=20and=20is=20on=20many=20of=20the=20"millions=20cds",=20and=20=
receiving=20much
>unsolicited=20and=20unwanted=20mail=20which=20doesn't=20look=20too=20much=
=20different
>from=20desirable=20mail=20from=20new=20strangers.=20
>

You=20raise=20an=20extremely=20important=20point=20and=20one=20which=20I=20=
fear=20too=20many
people=20overlook.=20=20I=20purposely=20don't=20filter=20everything=20caug=
ht=20by=20the
junkmail=20filter=20or=20passing=20through=20the=20whitelists=20into=20the=
=20trash
because=20it's=20far=20too=20easy=20for=20an=20email=20to=20be=20misidenti=
fied=20as=20junk=20if
it=20comes=20from=20someone=20who=20is=20not=20on=20your=20whitelist=20bec=
ause=20they=20are
"new=20strangers"=20or=20because=20they=20have=20changed=20email=20address=
es.

>So=20I=20started,=20and=20maintain=20(additions=20only),=20a=20filter=20f=
or=20the=20purpose
>of=20identifying=20strings=20in=20the=20header=20which=20indicate=20junk=20=
mail.=20It=20gets
>90%=20of=20incoming=20junk=20without=20checking=20any=20body=20content=20=
or=20for=20html.=20The
>DNSBLs=20miss=20more=20spams=20than=20this.=20And=20I=20do=20need=20to=20=
do=20some=20whitelisting
>in=20advance=20of=20this=20filter.
>

I=20looked=20over=20your=20junk=20mail=20filter=20and=20got=20some=20good=20=
ideas=20so=20I
thought=20I'd=20post=20mine.=20=20As=20you=20can=20see,=20I=20filter=20mor=
e=20on=20message=20bodies
instead=20of=20headers.

=3D=3D-=3D=3D-=3D=3D-=3D=3D-=3D=3D

body=3D"subscribe=20"|
body=3D"opt-out"|body=3D"opt-in"|body=3D"opt=20out"|body=3D"opt=20in"|
body=3D"you=20are=20receiving=20this"|
body=3D"To=20be=20removed"|
(body=3D"remove"&body=3D"subject")|
body=3D"removed=20from=20future=20mailings"|
(body=3D"web=20site"&body=3D"<html>")|
m=3D"lose=20weight"|
(body=3D"penis"&body=3D"enlarg")|
body=3D"one=20time=20mailing"|
body=3D"not=20spam"|body=3D"not=20a=20spam"|
m=3D"=20porn"|
(body=3D"click"&body=3D"<html>")|
(body=3D"click"&body=3D"http")|
body=3D"s.1618"|body=3D"s.=201618"|
m=3D"$$"|
body=3D"=20ad=20"|
body=20-s=3D"FREE"|
body=3D"result=20of=20your=20feedback=20form"|
h.subject=3D"ADV:"|
body=3D"orgies"|body=3D"orgy"|
body=3D"incest"|
body=3D"permanently=20remove"|
m=3D"0rgasm"|
m=3D"special=20offer"|
m=3D"=20rape"|
m=3D"=20cock"|
m=3D"penis=20size"|
m=3D"=20cum=20"|
m=3D"nude"|
m=3D"dicks"|
m=3D"18=20year"|
h.subject=3D"fuck"|
body=3D"size=20does=20matter"=20|=20body=3D"size=20matters"|
body=3D"rpcohen"|
body=3D"<html>"|body=3D"</body>"|body=3D"<A=20HREF"|body=3D"font=20size=3D=
"|
h.from=3D"big@boss.com"
h=3D"?big5?"|
h=3D"=B9"|
h=3D"=B2"|
h=3D"=B3"|
h=3D"=D0"|
h=3D"=3D?GB2312?"|
h=3D"=D5"|
h=3D"=AA"

=3D=3D-=3D=3D-=3D=3D-=3D=3D-=3D=3D

Ralph
- pmmail-list - The PMMail Discussion List ---------------------------
To POST to the list, send your message to:
pmmail-list@blueprintsoftwareworks.com

To UNSUBSCRIBE, send a message to mdaemon@bmtmicro.com 
with the first line of the message body being...
UNSUBSCRIBE pmmail-list@blueprintsoftwareworks.com
---------------------------------------------------------------------