Greylisting -- Was: Anti Spam

[Ted Mittelstaedt]

> -----Original Message-----
> From: Bart Silverstrim [mailto:bsilver at chrononomicon.com]
> Sent: Monday, April 30, 2007 12:08 PM
> To: Ted Mittelstaedt
> Cc: John Levine; freebsd-questions at freebsd.org
> Subject: Re: Greylisting -- Was: Anti Spam
>
>
> You're making it sound as if greylisting is a terrible idea

NO. I'm making it sound like greylisting is NOT the world's answer to
stopping spam.  It's NOT a miracle cure, it is NOT the last, best hope
for peace.

I'm making it sound like greylisting is just one more tool in the box
to stop spam - not espically better than many other tools, it has it's
good points and it's bad points, as do all the other tools.

Obviously you have a severe problem with this.  All I can say to that
is if you put all your spamfighting eggs in one basket, your foolish.

> because
> once your failure system won't notify you for some unspecified period
> of time.

Give it a rest.  That is one wart on greylisting.  There are others.  Just
as there are warts on all other spamfighting tools.

  I, and others most likely, are saying that it wouldn't take
> much for you to get it working just fine whether the cell carrier
> used it or not.  And even then, you haven't made a case that ISPs or
> businesses still couldn't use it

Right, because it was never my intention to make a case for NOT using it.

It was my original intention to show that greylisting worked because it
allows the blacklists time to get the submitter in their lists, not because
all spammers cannot tolerate greylisting delays because they are sending
spam so fast.  Which is what one of the OP's claimed was how greylisting
worked.

I then added to this later on the intention to show that depending on
greylisting alone will not work in the long haul, because it is easy
to program around it.  Which the spammers will do once a majority of sites
use greylisting, and indeed, many spammers are already starting to do
right now.

...the inconvenience you point out
> still could be worked around simply by doing what I suggested before,
> registering legit by periodically sending a quick message, and if you
> get "charged" for a short short message like that, then you probably
> need a new cell plan if that is pushing you over your free time, or
> start having your employer compensate you for using your personal
> equipment for business use.
>

yah yah yah whatever.  As I said before, you are so lost and hung up on
the monitoring example that you have completely misinterpreted everything
that I've said.  The point was not to get sidetracked into this stupid
monitoring example discussion.  The point was to discuss the merits and
problems of greylisting.

I frankly think that you are so in love with greylisting that you are
deliberately trying to AVOID a discussion of it's merits - because you
cannot bear to hear anything bad about it.

In summary, I run several busy mailservers, all that use greylisting.  I
have used greylisting for quite a while.  You can believe that or not.
I am stating that categorically, greylisting at the current time is
a quick hack, that in the majority of cases works, but it's effectiveness
has already started down the road to rapid decline, and every month I
am seeing more and more spam go right past it and get tagged by spamassassin
as being from a blacklisted spam emitter.  That DOES NOT MEAN that you
should NOT use it - no more than it means you should not use things like
SPF records as counters in a point-based spamfiltering system - it merely
means that it's getting less effective every day.

Ted