Really simple spam trap - /dev/pf permissions?

[John]

On Tue, Apr 27, 2010 at 12:44:14PM -0700, Randal L. Schwartz wrote:
> >>>>> "John" == John  <john at starfire.mn.org> writes:
> 
> John> (Obviously, I'll want to add to my cron scripts to age entries out
> John> of the spammers table, just to keep it down to a manageable size.
> John> I already have two dozen entries.)
> 
> You'll have a lot of collateral damage.  I've worked with a lot of
> schemes over the years for spamfighting.  A lot of spam is sourced
> inside corporate or educational choke points, meaning that a spam
> message from inside a company would block all remaining mail from that
> company.  So, for this to work, you really need to time out your blocks
> no more than an hour or two later, or legit mail will get unnecessarily
> delayed.

Grr.  I just expired the first address, at four hours old, and
IMMEDIATELY got a bunch Pfizer spams that were just delayed...

This is certainly not an easy nut to crack.
-- 

John Lind
john at starfire.MN.ORG