Slightly OT: Greylisting success or failure stories?

[Aleksandar Milivojevic]

Quoting David Cary Hart <Fedora at TQMcube.com>
Date: Sun, 06 Feb 2005 18:23:16

> After eight months, the same nitwits were still spamming, the instant
> that the new MX was propagated, to the tune of 3,000 emails per day to
> former employees. A timeout on a dead link is as expensive as it gets.

Spammers often adjust timeouts to be much lower than what is usually used for
normail mail traffic (or TCP/IP protocol itself).  At home, I'm running
SpamAssassin on an ancient slow machine.  Sometimes, spammers don't wait for
SpamAssassin to finish its job, they disconnect after relatively short timeout
(long enough for normal machine to finish SpamAssassin checks, too short for
this very old machine).  The reason is probably minimazing impact of tar-pits.

If you write filter that is as smiple and stupid as sleeping for 60 seconds
after "dot on the line by itself", you'll block some spam (not much, but some).
 Of course, I'm not suggesting actually implementing this.  It would be a very
bad thing if something like that become widespread (and as I already said, not
very efficient, you are looking in like blocking at most 1-2% of spam).

-- 
Aleksandar Milivojevic <amilivojevic at pbl.ca>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7