Blog entries tagged with "spam"

A month ago I installed a Thunderbird extension to give me a simple feature that has made the processing of my Inbox easier.

Ever since I started using SpamAssassin on my incoming email I have had two SPAM folders one that procmail automatically moves messages identified as SPAM into, and another that I manually move SPAM messages that were not identified as such.

Every few months I then run the contents of the manual folder through sa-learn to train the bayesian classifier.

So why is this significant?

Ever since I started to use rss2email for reading RSS feeds I have been running through the messages in my Inbox at least once a day in order to process it to (nearly) empty in a (sort of) GTD manner. As the majority of the messages are from RSS feeds the my most common action is delete, via the toolbar button (I click on the article link to bring it up in a new tab in Firefox and then return to my Inbox).

My next most common action is to move the message to the Spam/Manual folder. Even though it isn’t very complicated, every so often I drag the message to the wrong folder in the list down the side of the window. This was an annoyance and I wished that there could be a button to move the message.

A month ago I found Buttons!, an extension for Thunderbird that allows you to add a number of additional buttons to the toolbar. One of these is Archive! which moves the current message to a predefined folder.

So I now have two buttons; the standard Delete and right next to it a button that moves the message to Spam/Manual. This covers almost all of the actions I perform to process my Inbox.

In hindsight this doesn’t seem like much. But an optimisation of a daily process can be worth a lot more than you think.

Ever since I enabled comments I have been using the Akismet Plugin to combat spam which has been remarkably successful:

• Around 1,000 comments are identified as spam per fortnight.
• One or two comments are marked for moderation per week, all except one has been handled by clicking the ‘recheck queue for spam’ button.
• One comment slips through a month that I need to manually remove and mark as spam.

Today the following comment slipped through:

hello , my name is Richard and I know you get a lot of spammy comments , I can help you with this problem . I know a lot of spammers and I will ask them not to post on your site. It will reduce the volume of spam by 30-50% .In return Id like to ask you to put a link to my site on the index page of your site. The link will be small and your visitors will hardly notice it , its just done for higher rankings in search engines. Contact me icq ________ or write me __________ , i will give you my site url and you will give me yours if you are interested. thank you

I was speechless…

Three months ago I talked about the first step I was making to move from a default permit strategy to a default deny strategy for dealing with spam. Instead of having messages to any address at my domain ending up in my inbox I setup forwarders so only messages to a hundred or so addresses (based on non-spam emails that I had kept) ended up in my inbox with the remainder ended up in my (previously unused) gmail account.

So what have I found over the past three months?

• between fifty to five hundred messages were delivered to my gmail account every day
• of these at most ten per day were not identified as spam
• I identified two addresses that I then added to my list of valid addresses
• only eight of the addresses in my list have received spam
• of these there is one that receives the majority of the spam, almost two thousand in the last two weeks

This evening I changed the catch-all so the default action for my domain is now to reject messages and removed the forwarder rule for the spammed address so messages to that address will also be rejected. My next action is to go through my list of addresses and change the ones that I don’t think I need anymore to forward to my gmail account. A few months after that I will remove them if they are actually no longer used.

Back when I first setup this domain I configured a catch-all email address so that I could simply make up a unique email address on the fly when one was required for website registrations and similar uses. This has become unworkable as a few months ago someone started to use my domain in the from addresses which meant that all the bounce messages (not picked up by SpamAssassin) came to me, in the hundreds.

At one point (before I did some analysis and found out that most of the messages used different addresses) I considered changig the mail server config so these addresses were dropped. This accounts to a default permit policy which is the first of six dumb security ideas.

So what have I done? First I extracted all of the addresses that were used to send me the emails that I have retained, about 70 all up but a number of those are questionable, and created forwarding rules so that mesages send to these addresses will be forwarded on. Eventually I will remove the catch-all which will mean all of the unwanted emails will be dropped but in the interim I changed the catch-all to be my gmail account (that I never really used) so I can be sure I didn’t miss any addresses.

This does mean that I will need to create a new forwarding rule whenever I make up a new address but in the greater scheme I don’t do that very often and that small inconvenice will be overweighed by the huge reduction in the amount of spam I need to deal with.