Bug 218 - Local checksum db, count of deliveries, threshold
Summary: Local checksum db, count of deliveries, threshold
Status: RESOLVED WONTFIX
Alias: None
Product: Spamassassin
Classification: Unclassified
Component: spamassassin (show other bugs)
Version: 2.30CVS
Hardware: PC Linux
: P2 enhancement
Target Milestone: ---
Assignee: SpamAssassin Developer Mailing List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2002-04-17 06:12 UTC by Nathan Neulinger
Modified: 2002-06-15 03:58 UTC (History)
0 users


Attachment Type Modified Status Actions Submitter/CLA Status
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Nathan Neulinger 2002-04-17 06:12:39 UTC 
I'd like to see capability for a local checksum database for ALL inbound 
messages that spamd could use for a test. Have some sort of config option that 
would allow you to set a threshold for number of identical deliveries. 

The reason - recently we were targetted with a specific piece of hate mail that 
was directed at all of our membership. Since this was directed hate mail, and 
not spammed widely, it most likely would not have been caught by normal rules 
or razor.

Having the capability to check a local checksum would definately help. I'm not 
sure how beneficial it would actually be though, would need to be investigated.
Comment 1 Daniel Pittman 2002-04-17 06:48:01 UTC 
Subject: Re:  New: Local checksum db, count of deliveries,
 threshold

On Wed, 17 Apr 2002, bugzilla-daemon@hughes-family.org wrote:
> http://www.hughes-family.org/bugzilla/show_bug.cgi?id=218

[...]

> I'd like to see capability for a local checksum database for ALL
> inbound messages that spamd could use for a test. Have some sort of
> config option that would allow you to set a threshold for number of
> identical deliveries.

This is what the Distributed Checksum Clearinghouse[1] does. They offer
the server to you for the purpose of running a local filter based on
their technique as well as participating in the larger network of
servers sharing information.

[...]

> Having the capability to check a local checksum would definately help. 
> I'm not sure how beneficial it would actually be though, would need to
> be investigated.

Adding the DCC filtering, using only a local server, would allow you to
do this with existing code. :)

        Daniel

Footnotes: 
[1]  <http://www.rhyolite.com/anti-spam/dcc/>
Comment 2 Daniel Pittman 2002-04-17 06:48:26 UTC 
Subject: [SAdev] Re:  New: Local checksum db, count of deliveries,
 threshold

On Wed, 17 Apr 2002, bugzilla-daemon@hughes-family.org wrote:
> http://www.hughes-family.org/bugzilla/show_bug.cgi?id=218

[...]

> I'd like to see capability for a local checksum database for ALL
> inbound messages that spamd could use for a test. Have some sort of
> config option that would allow you to set a threshold for number of
> identical deliveries.

This is what the Distributed Checksum Clearinghouse[1] does. They offer
the server to you for the purpose of running a local filter based on
their technique as well as participating in the larger network of
servers sharing information.

[...]

> Having the capability to check a local checksum would definately help. 
> I'm not sure how beneficial it would actually be though, would need to
> be investigated.

Adding the DCC filtering, using only a local server, would allow you to
do this with existing code. :)

        Daniel

Footnotes: 
[1]  <http://www.rhyolite.com/anti-spam/dcc/>

-- 
Listen to the victim, abused by the system 
The basis is racist, you know that we must face this. 
"It can't happen here". Oh yeah? 
"Take a look around at the cities and the towns."
        -- Pop Will Eat Itself, _Ich Bin Ein Auslander_ (Dos Dedos Mis Amigos)

_______________________________________________
Spamassassin-devel mailing list
Spamassassin-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/spamassassin-devel
Comment 3 Nathan Neulinger 2002-04-17 06:56:54 UTC 
Very cool. I assumed that DCC was similar to Razor where it only tracked known 
spam.
Comment 4 Daniel Pittman 2002-04-17 16:49:30 UTC 
Subject: Re:  Local checksum db, count of deliveries, threshold

On Wed, 17 Apr 2002, bugzilla-daemon@hughes-family.org wrote:
> Very cool. I assumed that DCC was similar to Razor where it only
> tracked known spam.

No. I considered implementing it until I happened across a side note on
their site that lead to the explanation. The main problem it has is
false positives -- because it has no ability to decide what is or isn't
SPAM, it's very prone to false positives.

So, if you want it to work correctly you have a couple of choices as I
see them:

1) Whitelist everything that is sensible bulk email.
2) Submit anything that scores above 0 (or 1, 2, etc) to a local DCC.

The second option seems the most reasonable to me. That way you get
things that /may/ be SPAM added to the DCC processing which, if they
really are bulk, means that they will be noticed as such eventually.

This can all be done with procmail and friends, though adding support to
SpamAssassin for the client side[1] might make life easier.

        Daniel

Footnotes: 
[1]  Which has already been suggested, if (possibly) not listed in bugzilla.
Comment 5 Daniel Rogers 2002-04-17 17:27:56 UTC 
Yeah, Bug #71 is the DCC support one.  Also, I proposed a spam score cache back
in bug #128.

This is probably a duplicate of one or both of them.

Dan.
Comment 6 Craig Hughes 2002-06-10 00:36:18 UTC 
I'm going to close this out because as Daniel says, this is probably a dupe of one of those two bugs.  
Alternatively, it could also be that Razor2 solves this problem in yet another way.  In any case, 
implementing it as part of SA would be so close to duplicating DCC/Razor functionality that I don't 
think it makes sense for us to do it.