[SC-Help] Re: Spammers getting smarter?

[Mike Easter]

Geoff Lane wrote:
> "Mike Easter"
>> but among other things you should have whitelisted all
>> of your mailing lists and friends a long time ago.
>
> Unfortunately not so easy when a mailing list uses the OP's address in
> the From field (which is what TBUDL does) and the mailing list
> address in Reply-To. Spampal only appears to allow whitelisting on
> the From address, which implies that I need to whitelist every list
> member.

This kind of dialog is useful, but of course it isn't the same as if a
'filter consultant' were 'holding' your email in hir hand and making
suggestiongs about how to configure, but maybe this will be of some
piecemeal help anyway.

Here's what SP sez about how it works its whitelisting, from the manual.
This is very typical for whitelisting.

<snip>
Note: Headers that the whitelist compares against
The whitelist function only looks for email addresses in certain headers
of your email.

These headers are currently: From:, Reply-To:, Sender:, Mailing-List:
and Return-Path:
</snip>

So, if I look back at the 'Wrongly accused' thread first item with the
headers, I see this useful line:

Reply-To: tbudl at thebat.dutaint.com

and that's the addy I would use to whitelist the TBUDL mailing list.

> Also, I work freelance and get a significant amount of mail from
> prospective clients and agents. Often I haven't heard from someone for
> months or even years until one of their messages ends up in my
> spambin.

Yes, the problem with unknown wanted mail is the bugbear of spam
filtering.  Your filter shouldn't be tagging your unknown wanted mail,
even at the cost of increasing porosity a tiny little bit.

> Friends and family get whitelisted as soon as I know their address.
> However, I need to know their address first, and they usually seem to
> tell me by sending a message from the new address.

Ditto my above.

> Even if you don't get false positives, it doesn't mean that others
> don't. So, unqualified advice not to look at suspected spam (to decide
> whether it is actually spam) is IMO dangerous. I infered from your
> original post advice to the OP to rely on anti-spam filtering to
> decide whether each message was spam ("You should *not* be examining
> spam subjects and spam froms with your human eyeballs...") As I've
> pointed out, relying solely on something like Spampal is dangerous --
> Spampal is not infallible (and IIRC, advises against automatically
> deleting messages it tags as spam for precisely that reason).

That's a good point.  My configuration permits me to do that.  Until
someone else's configuration permits them to do that, we can't go 'post
hoc ergo propter hoc'

> That said, how can you be 100% sure that you have no undetected false
> positives? Surely, to be 100% sure means inspecting each trapped
> message, and I infer from your previous posts that you don't do that.

That's hard to describe.  You would have to see a 'video' or realtime of
my screen^1 during the spam submission parsing process.  Had you watched
me, you would feel quite comfortable that I'm not reporting any
non-spam.


^1That is actually possible with some cute little client server
softwares if both people are broadband connected

-- 
Mike Easter
kibitzer, not SC admin