Separating ham and spam

NE powerful technique to avoiding spam are E-mail addresses (accounts) which are not public. They can reside rather happily alongside more public address(es), but the level of ‘noise’ in each then varies. Reading habits benefit from the separation.

An odd suspicion should rise when a private (undisclosed) mail account is beginning to receive spam. Then, one can only spect that EITHER:

• A trusted person gave the E-mail address to a spammer or posted it publicly for ratbots to harvest

OR

• Somebody’s computer has been hijacked and address book data pulled from it, leading to misuse

This unfortunate scenario has recently hit me. At the end, it turned out that SpamAssassin was disabled, so I reported the fault to my host. My private account remains clean and has been clean for over a year. I warmheartedly recommend this tactic, which will be explained at greater depth if you follow the link above.

long time ago I argued that more people ought to digitally sign their E-mail messages. Unfortunately, very few people bother to do so. There are many benefits to encryption-based verification of one’s identity. Ultimately, it can lead to more trust, which can in turn prevent spam and make communication less susceptible to ‘noise’.

There recently emerged a word-of-mouth that signed messages are less likely to be intercepted by spam filters. As to whether this is true or not, I would have to say I doubt it. I am sorry to antagonise some people’s hopes, but several messages that I PGP-signed got flagged as spam (not by SpamAssassin). At least I was informed in all (probably two) occasions, but it was nonetheless worrisome. Quite recently I mentioned a trend whereby banning of autoresponders becomes prevalent. It is very important that moderators up above can discern spammers from those who attempt to fight spam in genuine and effective ways.

AST night, Brad Templeton pointed out that mail servers which run autoresponders or challenge/response filters could get blacklisted by spamcop.net. This is a database-driven Web site, which various spam filters rely on as a knowledgebase-type service. It also banned our LUG‘s mailing list earlier today.

I have been aware of the problems with such anti-spam tactics for quite some time, but never thought it could lead to this. As some commenters pointed out, other services may indirectly abolish anti-spam practices such as challenge/response, as well lead to banishment from people’s inboxes. Put in Brad’s words:

I learned a couple of days ago my mail server got blacklisted by spamcop.net. They don’t reveal the reason for it, but it’s likely that I was blacklisted for running an autoresponder, in this case my own custom challenge/response spam filter which is the oldest operating one I know of.

My personal solution, as posted in reply to the article, is to use a spam filter ‘on top’ of the challenge/response component. The intent: lowering the amount of challenges. One can reduce the likelihood of banishment in this way, as well as become less of a nuisance to the Net. In other words, it is possible to rule out cases when messsages are rather obviously spam. It leads to lower volume of messages being dispatched, which in turn can avoid blacklisting.

I use SpamAssasin, which is active at a layer higher than challenge/response (in this case Apache with BoxTrapper). Whatever gets scored as spam will be put aside in a mail folder which is reserved for spam. Only messages not marked as spam (and not in the whitelist either) will have a challenge delivered. This cuts down the number challenges by about 70% in my case. It never entails any false positive because I set the thresholds rather high.