Greylisting -- Was: Anti Spam

[Ted Mittelstaedt]

> -----Original Message-----
> From: Bart Silverstrim [mailto:bsilver at chrononomicon.com]
> Sent: Saturday, April 28, 2007 5:05 PM
> To: Ted Mittelstaedt
> Cc: Christopher Hilton; User Questions
> Subject: Re: Greylisting -- Was: Anti Spam
> 
> 
> >
> > Both of those are assumptions your making that are just not true  
> > anymore.
> > Spammers are adapting to greylisting.  I've been running it for at
> > least 2 years now and every month more and more spam is making it
> > past the greylist and getting caught by spamassassin.  As I mentioned
> > previously, it does not take a lot of programming effort to do it.
> 
> Sure they're adapting. They're also adapting to Spamassassin.

That's a bit different.  It is trivial to adapt to greylisting.  It is
not trivial to adapt to spamassassin, particularly if they have the
learner turned on.

> The  
> fact that it doesn't take a lot of programming effort isn't the  
> reason,

Yes, it is actually.  Because for the simple reason that the small
amount of programming effort required makes it possible to countermand
greylisting AT ALL.

It isn't possible, I think, for a spammer to programmically get through
a SA setup with the learner turned on, that has a dictionary that
has been built up through both ham and spam submissions.  The main
reason spammers do get past that has more to do with the difficult of
getting normal users to properly feed the learner.  But the problem from
the spammers point of view is that in the Internet, 10 different SA sites
could have 10 different rules.  But 10 different greylist sites will all
act the same, so if your going to put effort into countering the filters,
you would be smarter to counter greylisting first.

> though, since it doesn't take a lot of effort to NOT TOP POST  
> yet people continue to do so.
> 
> > When I first setup greylisting the results were literally spectacular.
> > Nowadays they are great, but not much beyond that.  All of the  
> > things your
> > saying about greylisting decreasing the load and all that are true,  
> > and
> > just because it's not as effective as it once was doesen't mean you  
> > should
> > not use it.  But, I am not blind to what my eyes are telling me.  In
> > aonther 5 years, greylisting will be like all other spamfilter
> > techniques, effective only against a minority of spam
> 
> And yet there are still people, despite the problem spammers are  
> creating, who think that email is a vital and reliable service upon  
> which to hinge the success or failure of their business relations.
>