Pointer: Foiling spam and other procmail email-filter tips
Felix Tilley
20:12:05 -0700, "Timo Salmi" <t...@uwasa.fi> wrote:
> The gentle readers processing their email on a Unix-system, or getting
> their email through a Unix-based system, might be interested in the
> following information.
I believe Timo has been using challenge/response for many years.
--
Felix Tilley
Rank: Capt
Fanatic Lartvocate
FL# 555-LART
Alan Connor
>
>
> In article <ts200402030...@loisto.uwasa.fi>, Mon, 02 Feb 2004
> 20:12:05 -0700, "Timo Salmi" <t...@uwasa.fi> wrote:
>
>> The gentle readers processing their email on a Unix-system, or getting
>> their email through a Unix-based system, might be interested in the
>> following information.
>
>
>
> I believe Timo has been using challenge/response for many years.
>
That's true. Mailing him was my first encounter with the concept, and his
program the first spam filter I'd ever found that actually got rid of the
stuff, and with no muss nor fuss.
AC
Karsten M. Self
> In article <ts200402030...@loisto.uwasa.fi> , Mon, 02 Feb 2004
> 20:12:05 -0700, "Timo Salmi" <t...@uwasa.fi> wrote:
>
> > The gentle readers processing their email on a Unix-system, or getting
> > their email through a Unix-based system, might be interested in the
> > following information.
>
>
>
> I believe Timo has been using challenge/response for many years.
He has.
The early adoptors are among the hardest to convince:
- C/R works when nobody is using it.
- C/R works when most of your correspondents are already entered into
it.
- C/R works when you run your own, highly tuned, self-hosted system,
and can minimize any false challenges.
What's overwhelmingly the case, though, is that C/R doesn't scale, it
doesn't work when everyone uses it, and it doesn't work when implmented
in turnkey, mass-deployed, end-luser, centralized systems.
Peace.
--
Karsten M. Self <kms...@ix.netcom.com> http://kmself.home.netcom.com/
What Part of "Gestalt" don't you understand?
America Trans Air (ATA) customer service sucks:
http://kmself.home.netcom.com/Rants/ata-sucks.html
Alan Connor
>
>
> On Monday 02 February 2004 08:31 pm, Felix Tilley wrote:
>
>> In article <ts200402030...@loisto.uwasa.fi> , Mon, 02 Feb 2004
>> 20:12:05 -0700, "Timo Salmi" <t...@uwasa.fi> wrote:
>>
>> > The gentle readers processing their email on a Unix-system, or getting
>> > their email through a Unix-based system, might be interested in the
>> > following information.
>>
>>
>>
>> I believe Timo has been using challenge/response for many years.
>
> He has.
>
> The early adoptors are among the hardest to convince:
>
> - C/R works when nobody is using it.
>
> - C/R works when most of your correspondents are already entered into
> it.
>
> - C/R works when you run your own, highly tuned, self-hosted system,
> and can minimize any false challenges.
>
> What's overwhelmingly the case, though, is that C/R doesn't scale, it
> doesn't work when everyone uses it, and it doesn't work when implmented
> in turnkey, mass-deployed, end-luser, centralized systems.
>
>
All of the above is pure garbage.
Karsten is a well-known anti-C/R propangandist who opposes such systems
for reasons of his own that I am sure he is not willing to discuss here.
But I do know this: A well made mail filter that use C/Rs as a stage in
the program can't be beat by spammers, and they hate them with a passion.
And I know that most of the spammers out their don't consider themselves
to be spammers:
It's the OTHER GUY'S Un-solicited Commercial Email that's ACTUALLY spam,
right Karsten?
And I know that proffessional spam-fighters hate them because they are simple
to use and low-maintenance and their services just aren't required.
Mail filters using C/Rs could easily be in universal use and at any scale
required.
And that would be the end of spam forever.
AC
Timo Salmi
> Mon, 02 Feb 2004 20:12:05 -0700, "Timo Salmi" <t...@uwasa.fi> wrote:
> > The gentle readers processing their email on a Unix-system, or getting
> > their email through a Unix-based system, might be interested in the
> I believe Timo has been using challenge/response for many years.
White/blacklist filtering since 1994 and CR since 1997. I do not
claim proprietorship or strict originality on any of these concepts.
Nevertheless, the methods, as presented, have been developed
independently without known precedents by yours truly.
All the best, Timo
--
Prof. Timo Salmi ftp & http://garbo.uwasa.fi/ archives 193.166.120.5
Department of Accounting and Business Finance ; University of Vaasa
mailto:t...@uwasa.fi <http://www.uwasa.fi/~ts/> ; FIN-65101, Finland
Timo's procmail tips at http://www.uwasa.fi/~ts/info/proctips.html
Timo Salmi
> > "Timo Salmi" <t...@uwasa.fi> wrote:
> > > The gentle readers processing their email on a Unix-system, or getting
> > > their email through a Unix-based system, might be interested in the
> > I believe Timo has been using challenge/response for many years.
> He has.
> The early adoptors are among the hardest to convince:
The merits and dismerits have been discussed so many times over that
it is not productive for me to recycle. I am not trying to convince
anyone else nor am I selling anything. So if others dislike or like
my methodology, I do not excessively worry, or feel pleased with it.
My concern is my own mailbox and the programming tricks involved.
All the best, Timo
--
Prof. Timo Salmi ftp & http://garbo.uwasa.fi/ archives 193.166.120.5
Department of Accounting and Business Finance ; University of Vaasa
mailto:t...@uwasa.fi <http://www.uwasa.fi/~ts/> ; FIN-65101, Finland
Timo's FAQ materials at http://www.uwasa.fi/~ts/http/tsfaq.html
Ben Finney
> The merits and dismerits have been discussed so many times over that
> it is not productive for me to recycle.
Agreed. And yet you do, unsolicited, at frequent intervals, for years:
<http://groups.google.com/groups?q=g:thl2948527308d&selm=ts9911180312.9684%40loisto.uwasa.fi>
> I am not trying to convince anyone else
Demonstrably untrue; every few weeks you post a message touting the
merits of "An Email Password System". If you're not trying to convince
anyone else, you're certainly acting like it.
> My concern is my own mailbox and the programming tricks involved.
If that were the case, you would not be posting frequent messages
touting the system.
--
\ "Many are stubborn in pursuit of the path they have chosen, few |
`\ in pursuit of the goal." -- Friedrich Nietzsche |
_o__) |
Ben Finney <http://bignose.squidly.org/>
Sam
> On Tue, 03 Feb 2004 08:55:13 GMT, Karsten M. Self <kms...@ix.netcom.com> wrote:
>>
>> The early adoptors are among the hardest to convince:
>>
>> - C/R works when nobody is using it.
>>
>> - C/R works when most of your correspondents are already entered into
>> it.
>>
>> - C/R works when you run your own, highly tuned, self-hosted system,
>> and can minimize any false challenges.
>>
>> What's overwhelmingly the case, though, is that C/R doesn't scale, it
>> doesn't work when everyone uses it, and it doesn't work when implmented
>> in turnkey, mass-deployed, end-luser, centralized systems.
>>
>>
>
> All of the above is pure garbage.
Let henceforth be known that we have a garbage expert here. If he says that
something is garbage, then it must be garbage. He knows a lot about
garbage, and his word is final!
> Karsten is a well-known anti-C/R propangandist who opposes such systems
> for reasons of his own that I am sure he is not willing to discuss here.
“Bullwinkle, warm up the black helicopter immediately!”
> But I do know this: A well made mail filter that use C/Rs as a stage in
> the program can't be beat by spammers, and they hate them with a passion.
And I know this: the best screwdriver mix is about 50-50 (for a certain
specific definition of “best”).
> And I know that most of the spammers out their don't consider themselves
> to be spammers:
Just like blithering idiots never consider themselves to be blithering
idiots, right?
> It's the OTHER GUY'S Un-solicited Commercial Email that's ACTUALLY spam,
> right Karsten?
And everyone else is stupid, only you are the smart one around here?
> And that would be the end of spam forever.
You better file a patent quick! You can get rich!
Alan Connor
>
>
> On 3 Feb 2004 12:41:26 +0200, Timo Salmi wrote:
>> The merits and dismerits have been discussed so many times over that
>> it is not productive for me to recycle.
>
> Agreed. And yet you do, unsolicited, at frequent intervals, for years:
>
> <http://groups.google.com/groups?q=g:thl2948527308d&selm=ts9911180312.9684%40loisto.uwasa.fi>
>
>> I am not trying to convince anyone else
>
> Demonstrably untrue; every few weeks you post a message touting the
> merits of "An Email Password System". If you're not trying to convince
> anyone else, you're certainly acting like it.
>
>> My concern is my own mailbox and the programming tricks involved.
>
> If that were the case, you would not be posting frequent messages
> touting the system.
>
Every few weeks is hardly "frequent", and he was not referring to his public
service posts in that quote above, but rather the sort of nonsense that you
have posted here, where those that are extremely and irrationally prejudiced
against the use of C/Rs maliciously twist the meanings of others posts in
order to make their falsehoods seem true.
And he does not "tout the system" but simply offers it as a choice to people.
An option.
Which it is, whether you like it or not.
AC
Timo Salmi
> On 3 Feb 2004 12:41:26 +0200, Timo Salmi wrote:
> > The merits and dismerits have been discussed so many times over that
> > it is not productive for me to recycle.
> Agreed. And yet you do, unsolicited, at frequent intervals, for years:
(and so on and on)
Dear Ben,
I am simply walking away from your aggression.
All the best, Timo
--
Prof. Timo Salmi ftp & http://garbo.uwasa.fi/ archives 193.166.120.5
Department of Accounting and Business Finance ; University of Vaasa
mailto:t...@uwasa.fi <http://www.uwasa.fi/~ts/> ; FIN-65101, Finland
Shmuel (Seymour J.) Metz
at 05:12 AM, t...@UWasa.Fi (Timo Salmi) said:
>21. How do I automatically return certain email messages?
You can't. All that you can do is to forward it to an address
extracted from the envelope or header. If that address is forged, then
you wind up spamming a third party.
--
Shmuel (Seymour J.) Metz, SysProg and JOAT
Unsolicited bulk E-mail will be subject to legal action. I reserve
the right to publicly post or ridicule any abusive E-mail.
Reply to domain Patriot dot net user shmuel+news to contact me. Do
not reply to spam...@library.lspace.org
Alan Connor
>
My little script tells me that you still have that illegal sig, so I won't
be reading anymore of your post here.
Do you still threaten to sue anyone that sends you spam?
And let me guess: You still have never sued anyone and you still get plenty
of spam.
Go away, you fucking idiot scofflaw.
(the rest deleted unseen)
AC
--
ed(1)
25K of troll-control
The perfect Usenet editor/pager
Timo Salmi
> >21. How do I automatically return certain email messages?
> You can't. All that you can do is to forward it to an address
> extracted from the envelope or header. If that address is forged, then
> you wind up spamming a third party.
That is non-information. A truims that is just a twist of the
strawman strategy.
Ben Finney
> Shmuel (Seymour J.) Metz <spam...@library.lspace.org.invalid> wrote:
>> at 05:12 AM, t...@UWasa.Fi (Timo Salmi) said:
>
>> >21. How do I automatically return certain email messages?
>
>> You can't. All that you can do is to forward it to an address
>> extracted from the envelope or header. If that address is forged, then
>> you wind up spamming a third party.
>
> That is non-information.
It's highly relevant information, especially for those considering the
use of automated email challenge systems to fight spam. Sending spam as
a response to spam is, at best, inconsiderate and counterproductive.
> A truims that is just a twist of the strawman strategy.
A truism is one that is undoubted or self-evidently true. While that
may be overstating the case here, it's good to see you acknowledge the
truth of the assertion.
A straw man argument argues against a position that differs from the one
stated. That doesn't seem to be the case here; Seymour points out a
relevant flaw of challenge-response email robots.
--
\ "Marriage is a wonderful institution, but who would want to |
`\ live in an institution." -- Henry L. Mencken |
Alan Connor
>
>
> On 7 Feb 2004 00:06:16 +0200, Timo Salmi wrote:
>> Shmuel (Seymour J.) Metz <spam...@library.lspace.org.invalid> wrote:
>>> at 05:12 AM, t...@UWasa.Fi (Timo Salmi) said:
>>
>>> >21. How do I automatically return certain email messages?
>>
>>> You can't. All that you can do is to forward it to an address
>>> extracted from the envelope or header. If that address is forged, then
>>> you wind up spamming a third party.
>>
>> That is non-information.
>
> It's highly relevant information, especially for those considering the
> use of automated email challenge systems to fight spam. Sending spam as
> a response to spam is, at best, inconsiderate and counterproductive.
>
>> A truims that is just a twist of the strawman strategy.
>
> A truism is one that is undoubted or self-evidently true. While that
> may be overstating the case here, it's good to see you acknowledge the
> truth of the assertion.
>
> A straw man argument argues against a position that differs from the one
> stated. That doesn't seem to be the case here; Seymour points out a
> relevant flaw of challenge-response email robots.
Why do you keep posting this same NONSENSE?
You are full of shit to your eyeballs, and even worse than that,
you KNOW that you are lying.
And NO, I am not getting into another idiotic point-by-point argument with
you.
On this subject you are a fucking LOON.
AC
Timo Salmi
> On 7 Feb 2004 08:52:28 +1050, Ben Finney <bignose-h...@and-benfinney-does-too.id.au> wrote:
> > On 7 Feb 2004 00:06:16 +0200, Timo Salmi wrote:
> >> Shmuel (Seymour J.) Metz <spam...@library.lspace.org.invalid> wrote:
> >>> at 05:12 AM, t...@UWasa.Fi (Timo Salmi) said:
> >>> >21. How do I automatically return certain email messages?
> >>> You can't. All that you can do is to forward it to an address
> >> That is non-information.
> > It's highly relevant information, especially for those considering the
> > use of automated email challenge systems to fight spam. Sending spam as
The posting was non-information, since it already is in the said
item: "But be sensible in using the method, since most spam has
forged senders". Furthermore, blacklisting can well be used for
purposes other than avoiding spam. In fact, its most effective usage
is against pests (that's what the second example in the item is
explicitly about, whether one returns or just /dev/null's).
The categoric bait statement "You can't" is logically and probably
also deliberately wrong. Not every pest on the net posts from a
forged address.
If a handle is sought, the CR critique should rather be against
http://www.uwasa.fi/~ts/info/spamfoil.html since the item #21 is not
about CR. Seeing things in all places is not convincing.
> Why do you keep posting this same NONSENSE?
It is so much easier to attack than actually to produce something,
or even to present constructive criticism. Don't fall for it.
Alan Connor
I try, Professor, I really do.
I need to learn to deal with trolls the same way I now deal with spam, thanks
to your Passlist/C-R mail system: Just be a duck and let the water run off
my back...
:-\
AC
Sam
> I try, Professor, I really do.
Anyone seen Mary-Ann?
> I need to learn to deal with trolls the same way I now deal with spam, thanks
> to your Passlist/C-R mail system: Just be a duck and let the water run off
> my back...
As the saying goes: if it walks like a duck and quacks like a duck, then it
must be an Alan.
Shmuel (Seymour J.) Metz
at 12:06 AM, t...@UWasa.Fi (Timo Salmi) said:
>That is non-information.
Not at all. Your question 21 promises more than it can deliver, and
pointing that fact out is information. The fact that the correction is
a truism makes your error even less excusable. Worse, your answer to
your question 21 has the same error. It does not return spam to the
sender, but rather assists the spammer in victimizing additional
recipients. In an era when the majority of spam has bogus envelope and
headier data, your recipe can only be considered to be abuse.
Certainly if someone "returned" to me a message that I hadn't sent, I
would report it as spam.
Tim Haynes
> In <c0134o$t...@poiju.uwasa.fi>, on 02/07/2004
> at 12:06 AM, t...@UWasa.Fi (Timo Salmi) said:
>
>>That is non-information.
>
> Not at all. Your question 21 promises more than it can deliver, and
> pointing that fact out is information. The fact that the correction is a
> truism makes your error even less excusable. Worse, your answer to your
> question 21 has the same error. It does not return spam to the sender,
> but rather assists the spammer in victimizing additional recipients. In
> an era when the majority of spam has bogus envelope and headier data,
> your recipe can only be considered to be abuse. Certainly if someone
> "returned" to me a message that I hadn't sent, I would report it as spam.
Agreed entirely. Quite apart from the above, it also is a waste of space &
time to process the generated mail, whether or not it hits a (let alone
*the*) valid recipient.
I also am interested in knowing what Timo's magic recipe for reliably
returning mails to their (real) senders might be.
~Tim
--
18:33:12 up 67 days, 21:47, 2 users, load average: 0.35, 0.49, 0.34
pig...@stirfried.vegetable.org.uk |Can you tell me how to get,
http://spodzone.org.uk/cesspit/ |How to get to Sesame Street?