CBP: Spam and Virus Handling (was Re: [clug] [AUSCERT ALERT - Email worm W32.Beagle.A/Win32.Bagle.A])

[Alex Satrapa]

On 19 Jan 2004, at 21:32, Michael Carden wrote:

> What is the current Best Practice method of dealing with the broad 
> issue of
> SPAM?

I've tried using SpamAssassin for spam* filtering at home, but it 
appears that the Debian maintainer is still packaging really old 
useless rules. The SpamAssassin distribution comes with rules that look 
much better.

The ruleset deployed by Goldweb is particularly effective in labelling 
spam, especially when compared to the Debian package.

> So what works well for you? I'm not asking 'What great new technique 
> did you
> read about in an obscure journal from the University of Discordia,' 
> but what
> do you use that takes the sting out of spam?

One great technique I read about was only accepting email from 
addresses on your whitelist - a variant of the "block everything except 
the stuff you want or need" rule. People can add themselves to the 
whitelist by subscribing to it through a web page and sending you an 
email within a certain timeout period (or sending an email containing a 
specific time-sensitive key, or whatever).

Another scheme I've heard of is to reject mail that isn't 
cryptographically signed - the theory being that it's too expensive for 
spammers to sign each email individually.

Both of these schemes might work for an individual, but I can't imagine 
an ISP being too popular if they set up systems such as that ;)

Regards
Alex Satrapa

*NB: SPAM is a trademark of Hormel foods. spam is an alias for UCE and 
UBE

"Everyone has 20/20 vision in hindsight" -- Old Proverb
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 194 bytes
Desc: This is a digitally signed message part
Url : http://lists.samba.org/archive/linux/attachments/20040119/870c03f1/PGP.bin