OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: Patch: DEFER in header/body checks

From: /dev/rob0 (rob0gmx.co.uk)
Date: Mon Aug 22 2005 - 09:46:16 CDT


On Monday 2005-August-22 09:34, Noel Jones wrote:
> At 09:15 AM 8/22/2005, Victor Duchovni wrote:
> > > Someone wanted to use a header inserted by a proxy filter to
> > > defer mail.
> >
> >Why? So that the sender would find out the mail did not get through
> > 5 days later?
>
> A greylisting idea. Subsequent mail would not have the header that
> trigger DEFER.

And this is the part I don't like about it. It would be better to use
other means to identify spam suspects, rather than reading the message
content. Existing policy daemons could be adapted to apply greylisting
only to RBL positives or IP space likely to be dynamic or to sender /
helo / rDNS mismatches. Content-based greylisting means that the
message body is received twice.

IMO content filtering should be only a last ditch defense. I think I'm
doing quite well without it. Spam is no longer a major issue for my
users, and neither are they missing any mail they wanted.
--
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header