4 ms·

This is going to make spammers so happy.

by alexkavon 10y ago

voltagex_ 10y ago
Why?
- viraptor 10y ago
  Gmail and other really big providers are in a unique position for spam filtering. They have so many users that they get a continuously trained filter pretty much for free. They can instantly classify never-seen-before kind of spam in minutes because someone gets push notification on their phone and clicks "this is spam". Nobody with purely-technical solution to this problem can be better in practice. (although we're pretty close) This means you're more likely to get actual spam in your custom deployment.
  - eikenberry 10y ago
    This is a definite trade off. I have my personal mail server + a gmail account and gmail is better at spam prevention. It isn't that much better though as local Bayesian filters do very well.
  - drdaeman 10y ago
    Run a honeypot. Just an usual Postfix with catch-all virtual mailbox and a learn-spam for the destinatin. Let spammers happily fill it (they will, in no time) and train your very own rspamd/spamassasin/whatever. Sure, this works as long as they don't try to poison your filters, but given its a small and rare target, it's unlikely someone would bother.
    - viraptor 10y ago
      A proper honeypot takes a lot of time and effort. You actually have to inject that email into the right environments. For example nobody will steal your honeypot address from someone's mail history, some service's stolen user database, or others. It helps, but it's not a solution.
  - dingaling 10y ago
    What types of spam do other people see in their personal mail servers? The majority of spam I receive is from addresses that have been leaked ( Santander bank is particularly bad for those for some reason ) or bought in an acquisition; perhaps two or three per year. I just blacklist those addresses. What really annoys me, though, is that eBay passes my unique-to-them email address to vendors from whom I buy items and several of them have added me to their mailing lists over the years, but thankfully de-subscribe has always worked.
  - insertnickname 10y ago
    I run my own mail server, and I get very little spam. Sometimes I go for days without a single spam message even getting through to my spam folder, much less my inbox. The last spam mail that got through to my spam folder was on November 25th. And it's not because spammers don't try, my server has rejected 206 mails in the last ~24 hours (and that's not counting the attempted open relay abuse). My setup consists of Postfix with postscreen and SpamAssassin. Postscreen blocks clients on a certain type of protocol error that spammers are prone to (speaking out of turn) and based on DNSBLs[1], notably zen.spamhaus.org, which blocks most spammers. SpamAssassin, in addition to the standard rules and bayes filtering, is configured with Pyzor, Razor2, DCC, and iXhash, and I have some custom rules as well. I actually get far less spam with my self-hosted setup than I did when I used a paid e-mail service (although it was not Google). Public IP reputation (DNSBLs) and spam fingerprint databases (Pyzor, Razor2, DCC, iXhash) make self-hosted spam filtering very feasible. 1: https://en.wikipedia.org/wiki/DNSBL https://en.wikipedia.org/wiki/DNSBL
    - eps 10y ago
      May want to throw postgrey in a mix. Incredulously, asking first-time senders to retry in a bit still filters out the vast majority of spam.
      - insertnickname 10y ago
        I intend to switch to rspamd soon, which has built-in greylisting. However, in my test run with rspamd I did not get good enough results because my current SpamAssassin setup relies heavily on rejecting spam that hits two or more content filters (bayes, pyzor, etc.). I will need to implement at least a pyzor plugin for rspamd before I can switch. rspamd, in addition to bayes filtering, has it's own fuzzy fingerprinting system. You can use your own fingerprint db and/or a public one. The public one that is configured in rspamd by default didn't seem to catch any of the spam I get though.
        eps 10y ago
        Don't know about rspamd, but SpamAssassin used to be way too aggressive in its stock config. E.g., it had a default rule for some "MS-Outlook" headers that just happen to be in every email sent from Outlook via a non-Exchnage mail server. That created a ton of false positives - wasn't hard to fix, but still it was a hassle.
  - cm2187 10y ago
    I receive tons of spam (on a very old email address). I am progressively transitioning to giving a unique email alias for each service. 1. If the address gets leaked or sold I can identify the culprit and stop the spam by deleting the alias 2. It is a useful security measure too, if a website gets hacked, it becomes harder to correlate my account across websites since it is a unique, non predictable address.
- alexkavon 10y ago
  Well email is a complicated beast, so much so that most it's security related features are not included right out of the box. Some of these features are used to help determine spam (i.e. Spammer doesn't usually setup things like SPF or DKIM records). Mail-in-a-box provides a solution to a lot of these other components, thus not requiring the spammer to set much up at all. Making them more reliable to spam engines than before. I'm not saying Mail-in-a-box is a one stop shop spammer solution, but it's pretty close.

This is going to make spammers so happy.

voltagex_ 10y ago

Why?

viraptor 10y ago
Gmail and other really big providers are in a unique position for spam filtering. They have so many users that they get a continuously trained filter pretty much for free. They can instantly classify never-seen-before kind of spam in minutes because someone gets push notification on their phone and clicks "this is spam". Nobody with purely-technical solution to this problem can be better in practice. (although we're pretty close) This means you're more likely to get actual spam in your custom deployment.
- eikenberry 10y ago
  This is a definite trade off. I have my personal mail server + a gmail account and gmail is better at spam prevention. It isn't that much better though as local Bayesian filters do very well.
- drdaeman 10y ago
  Run a honeypot. Just an usual Postfix with catch-all virtual mailbox and a learn-spam for the destinatin. Let spammers happily fill it (they will, in no time) and train your very own rspamd/spamassasin/whatever. Sure, this works as long as they don't try to poison your filters, but given its a small and rare target, it's unlikely someone would bother.
  - viraptor 10y ago
    A proper honeypot takes a lot of time and effort. You actually have to inject that email into the right environments. For example nobody will steal your honeypot address from someone's mail history, some service's stolen user database, or others. It helps, but it's not a solution.
- dingaling 10y ago
  What types of spam do other people see in their personal mail servers? The majority of spam I receive is from addresses that have been leaked ( Santander bank is particularly bad for those for some reason ) or bought in an acquisition; perhaps two or three per year. I just blacklist those addresses. What really annoys me, though, is that eBay passes my unique-to-them email address to vendors from whom I buy items and several of them have added me to their mailing lists over the years, but thankfully de-subscribe has always worked.
- insertnickname 10y ago
  I run my own mail server, and I get very little spam. Sometimes I go for days without a single spam message even getting through to my spam folder, much less my inbox. The last spam mail that got through to my spam folder was on November 25th. And it's not because spammers don't try, my server has rejected 206 mails in the last ~24 hours (and that's not counting the attempted open relay abuse). My setup consists of Postfix with postscreen and SpamAssassin. Postscreen blocks clients on a certain type of protocol error that spammers are prone to (speaking out of turn) and based on DNSBLs[1], notably zen.spamhaus.org, which blocks most spammers. SpamAssassin, in addition to the standard rules and bayes filtering, is configured with Pyzor, Razor2, DCC, and iXhash, and I have some custom rules as well. I actually get far less spam with my self-hosted setup than I did when I used a paid e-mail service (although it was not Google). Public IP reputation (DNSBLs) and spam fingerprint databases (Pyzor, Razor2, DCC, iXhash) make self-hosted spam filtering very feasible. 1: https://en.wikipedia.org/wiki/DNSBL https://en.wikipedia.org/wiki/DNSBL
  - eps 10y ago
    May want to throw postgrey in a mix. Incredulously, asking first-time senders to retry in a bit still filters out the vast majority of spam.
    - insertnickname 10y ago
      I intend to switch to rspamd soon, which has built-in greylisting. However, in my test run with rspamd I did not get good enough results because my current SpamAssassin setup relies heavily on rejecting spam that hits two or more content filters (bayes, pyzor, etc.). I will need to implement at least a pyzor plugin for rspamd before I can switch. rspamd, in addition to bayes filtering, has it's own fuzzy fingerprinting system. You can use your own fingerprint db and/or a public one. The public one that is configured in rspamd by default didn't seem to catch any of the spam I get though.
      - eps 10y ago
        Don't know about rspamd, but SpamAssassin used to be way too aggressive in its stock config. E.g., it had a default rule for some "MS-Outlook" headers that just happen to be in every email sent from Outlook via a non-Exchnage mail server. That created a ton of false positives - wasn't hard to fix, but still it was a hassle.
- cm2187 10y ago
  I receive tons of spam (on a very old email address). I am progressively transitioning to giving a unique email alias for each service. 1. If the address gets leaked or sold I can identify the culprit and stop the spam by deleting the alias 2. It is a useful security measure too, if a website gets hacked, it becomes harder to correlate my account across websites since it is a unique, non predictable address.
alexkavon 10y ago
Well email is a complicated beast, so much so that most it's security related features are not included right out of the box. Some of these features are used to help determine spam (i.e. Spammer doesn't usually setup things like SPF or DKIM records). Mail-in-a-box provides a solution to a lot of these other components, thus not requiring the spammer to set much up at all. Making them more reliable to spam engines than before. I'm not saying Mail-in-a-box is a one stop shop spammer solution, but it's pretty close.