[SLUG] SPAM prevention

From: Derek Glidden (dglidden@illusionary.com)
Date: Wed Jan 09 2002 - 14:39:33 EST


On Tue, 2002-01-08 at 22:40, Paul M Foster wrote:
> On Tue, Jan 08, 2002 at 09:04:16PM -0500, Russell Hires wrote:
>
> > You mean this isn't actual spam? :-) I trust you on this.
>
> What a mistake! ;-}
>
> No, I believe we did actually get some books from these guys that went
> out in raffles, and I do (rarely) get some email from them.
>
> Since my name's on everything, you wouldn't believe the spam I get in
> the name of SLUG. I only pass on things from entities I know, or which

This seems like an ideal time to mention two Anti-SPAM projects I've
been tracking recently:

Vipul's Razor: http://razor.sourceforge.net/

and

Junkfilter: http://junkfilter.zer0.org/

They are both run through Procmail, so you will need to have some kind
of access to your mail server to use them, and of course your mail
server must be a machine capable of running Procmail. (You should be
able to use either of them in conjunction with something like
"fetchmail" I think.)

Junkfilter is a mother of all procmail rules that scores a given email
based on about a bazillion things like keywords, known SPAM-harboring
domains, etc. If an email's score passes a certain threshhold, it's
considered SPAM and you can do what you want with it. It's nice because
it's all one self-contained ruleset, but is difficult to upgrade without
downloading a new set of rules and replacing your existing
installation. It's about 95% effective, although that figure goes down
a bit the longer between updates of the rulsets, and occasionally gets
false-positives. (about 0.5% max false positives in my experience.)
Also, because the ruleset is so large, it may affect mail processing
time on extremely heavily-loaded servers.

Vipul's Razor is works by comparing "fingerprints" of known SPAM
messages and is "distributed" in the sense of, if you receive a SPAM
that did not get filtered, you can forward it to a processor that will
generate an appropriate fingerprint and now everybody who uses Vipul
will know that that particular message should be considered SPAM. You
should *never* get false positives, but occasional un-fingerprinted SPAM
may get through. However, you will need network connectivity to use it,
and your email delivery may operate slower because each email requires a
connection to a processing server - although it appears you *may* be
able to run your own processing server local to your email server. The
more people who use Vipul's Razor, the better it gets. (I'm not sure
how it would go about handling false positives. I suspect a certain
number of people must submit an email as SPAM before it gets accepted.
In any case, YOU decide what to do with positive matches - I file them
away in a "SPAM" folder and periodically clean the SPAM out of it and
copy any false positives back into my mailbox.)

I personally use Junkfilter, just because I haven't bothered to set up
Vipul on my mail server yet. I'll probably migrate over to that one
eventually.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
#!/usr/bin/perl -w
$_='while(read+STDIN,$_,2048){$a=29;$b=73;$c=142;$t=255;@t=map
{$_%16or$t^=$c^=($m=(11,10,116,100,11,122,20,100)[$_/16%8])&110;
$t^=(72,@z=(64,72,$a^=12*($_%16-2?0:$m&17)),$b^=$_%64?12:0,@z)
[$_%8]}(16..271);if((@a=unx"C*",$_)[20]&48){$h=5;$_=unxb24,join
"",@b=map{xB8,unxb8,chr($_^$a[--$h+84])}@ARGV;s/...$/1$&/;$d=
unxV,xb25,$_;$e=256|(ord$b[4])<<9|ord$b[3];$d=$d>>8^($f=$t&($d
>>12^$d>>4^$d^$d/8))<<17,$e=$e>>8^($t&($g=($q=$e>>14&7^$e)^$q*
8^$q<<6))<<9,$_=$t[$_]^(($h>>=8)+=$f+(~$g&$t))for@a[128..$#a]}
print+x"C*",@a}';s/x/pack+/g;eval 

usage: qrpff 153 2 8 105 225 < /mnt/dvd/VOB_FILENAME \ | extract_mpeg2 | mpeg2dec -

http://www.cs.cmu.edu/~dst/DeCSS/Gallery/ http://www.eff.org/ http://www.anti-dmca.org/



This archive was generated by hypermail 2.1.3 : Fri Aug 01 2014 - 18:31:16 EDT