Re: Feasability of E-Mail Laundering Service

--nextPart1328080.Qqmg5pl8nq
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

On Wednesday 25 May 2005 05.58, Lorrie Wood wrote:

> A friend of mine has an account with an ISP whose spam filtering isn't
> as good as mine. What I want to do (with her complete permission) is to
> run a mail laundering service: I pick up mail from her ISP, process it
> through my postfix et al, and deposit it into an account on my machine.

The big problem with spam filtering like this is: at the time where the=20
filtering occurs, you have already received the spam. So, your=20
alternatives are:
- tag it (and file it into a spam folder.) The only sane way, imnsho - bu=
t=20
obviously the big disadvantage is that the user still sees the spam and has=
=20
to look through it to make sure nothing non-spammy gets deleted because it=
=20
was tagged as spam for some reason.
- bounce it back to the sender. While some people unfortunately still do=
=20
this, this is the worst thing you can do. The sender address on spam mails=
=20
is almost always faked, so you're bouncing spam to innocent bystanders.
- delete it. While this apparently solves the problem, you occasionally=20
*will* have a non-spam message which gets deleted because it looked like=20
spam. For me, the possibility of deleting a non-spam mail is inacceptable=
=20
=2D email currently is a quite reliable tool, and I want to keep it that wa=
y.

Summary: the only reasonable thing you can offer your friend is to run the=
=20
mail through spamassassin/dspam/whatever and file the spam into a folder of=
=20
its own.

(NOTE: contrary to spam, trojans/viruses can be recognized with virtually n=
o=20
false positives, given a decent scanner, so silently deleting trojans can=20
be reasonable - at least until the next malware pops up which attaches=20
itself to legit payload.)

cheers
=2D- vbi

--nextPart1328080.Qqmg5pl8nq
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: get my key from http://fortytwo.ch/gpg/92082481

iKcEABECAGcFAkKUJLhgGmh0dHA6Ly9mb3J0eXR3by5jaC9sZW dhbC9ncGcvZW1h
aWwuMjAwMjA4MjI/dmVyc2lvbj0xLjUmbWQ1c3VtPTVkZmY4NjhkMTE4NDMyNzYw
NzFiMjVlYjcwMDZkYTNlAAoJECqqZti935l6FhoAnjDcBpGI07 CdvhN3bwLQYW1E
fbb1AJ9bBV4XpfqU3DdJjgWENbU3N18EAQ==
=JbwV
-----END PGP SIGNATURE-----

--nextPart1328080.Qqmg5pl8nq--