Re: Slightly OT: Greylisting success or failure stories?

From: Thomas Cameron (thomas.cameron_at_camerontech.com)
Date: 02/07/05

  • Next message: Matthew Saltzman: "Re: Attaching a monitor to a laptop." 
    To: "For users of Fedora Core releases" <fedora-list@redhat.com>
Date: Sun, 6 Feb 2005 18:36:54 -0600

    ----- Original Message -----
    From: "Craig White" <craigwhite@azapple.com>
    To: <jaymo@mail.bokler.com>; "For users of Fedora Core releases"
    <fedora-list@redhat.com>
    Sent: Sunday, February 06, 2005 4:54 PM
    Subject: Re: Slightly OT: Greylisting success or failure stories?

    > On Sun, 2005-02-06 at 14:40 -0600, Jay Moore wrote:
    >> AFAIK, all greylisting implementations use pretty much the same logic:
    >> if the tuple (ip addr, from:, to:) is not in the "whitelist", return a
    >> tempfail (450). A server is automatically "whitelisted" if he tries the
    >> same tuple after a designated time has elapsed (e.g. 30 minutes). It is
    >> effective apparently 'cause most spammers don't retry their connections.
    > ---
    > the entire point of spam is low cost. If the 'cost' is raised, it makes
    > it less attractive. If a spam server has to keep retrying connections
    > (the tempfail), it becomes expensive and reduces the amount of mail
    > xfers that any one computer or server can deliver.

    But the vast majority of spam comes from spambots or open relays - these
    don't cost the spammers a penny, and they don't care about quality of
    delivery.

    > The most effective tools have always revolved around 'tar pits' of some
    > kind, designed to elevate the cost of delivery. Managing one of these
    > tar pits has a cost too, as you must have some backend database to
    > handle the the tuple attempts and whitelisting or even blacklisting. The
    > cost however seems insignificant compared to the cost of checking each
    > and every one with spamassassin.

    I have looked at tarpits, and in my opinion, they don't really do any good.
    Almost no spam traffic actually comes from the spammers. It comes from bots
    or something like that. While tarpitting might slow an insignificant amount
    of the spam down, I don't think it's enought to make it worth the hassle of
    setting up the tarpit.

    Spammers are also pretty retarded - I've got an e-mail address that I
    stopped using over 4 years ago. I still own the domain, though, and there
    is an MX record for it. I am amazed to see that this old e-mail address
    which has been inactive for over 4 years still gets several *hundred* spam
    messages a day. The address wound up on some address list which has been
    sold and resold between spammers for years. They don't care that the
    addresses are no good.

    Thomas 

    -- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
  • Next message: Matthew Saltzman: "Re: Attaching a monitor to a laptop."

    Relevant Pages

    • Re: Spam - Small Claims - Damages
      ... It's just that, if you have to have something to keep out the spam from the rest of the world, the additional time and cost of dealing with uk spam as well is almost non-existent. ... My server is bright enough to realise it needs to shut down when overwhelmed - so inbound mail was offline for around 12 hours. ... Just because a lot of spammers are out of reach does not mean those that are within reach should be left to run riot. ...
      (uk.legal)
    • stripping HTML, etc (was Re: Asking if elements in struct arre zero)
      ... >> The only HTML email I receive is spam where the HTML has been used to ... If one's only goal is to test for spam, ... The spammers are doing this because people are stripping HTML ... Since the cost and risk is miniscule -- especially ...
      (comp.lang.c)
    • Re: increase in spam and what to do about it
      ... because your potential customer is using an ISP that happens to get ... As fast as you can come up with a trechnical solution the spammers will ... doesn't stop spam but is very likely to make the innocent pay for it. ... organization, ie. ISP - include hefty fines in your customer contract, ...
      (comp.os.vms)
    • Ethics of Deterrence
      ... against spammers' sites. ... community really was involved in a DDoS. ... complain about spam you receive. ... just complain about spam messages reaching us. ...
      (comp.dcom.telecom)
    • Re: increase in spam and what to do about it
      ... RBL at a different place. ... but I can assure you there is no way for spammers ... doesn't stop spam but is very likely to make the innocent pay for it. ... You put serious penalties in the contract. ...
      (comp.os.vms)