Experimental Anti-spam

Jeremy Howard · 1 Apr 2002, 10:47 PM

OK brace yourself. This is so cool...

I've installed SpamAssassin on FastMail.FM. At this stage it is only available for testing by Enhanced subscribers. Click 'Spam protection' on the Preferences screen.

It creates a 'spam score'. It works on all messages, even stuff collected through POP/Hotmail links! The score uses these rules. To summarise the main rule types:

Razor: Creates a checksum of the message and compares it to recently reported spam in a global database; if they match, it's spam!
DNSBL: Check all servers in the SMTP path for open relays, open proxies, and blacklisted hosts in many blacklists, each one weighted differently depending on past results
Header and body checks: Various checks for common spam phrases like "This is not spam!" and "This is sent in compliance with bill S1618"
Structure: Checks whether it's HTML mail, has an embedded form, contains formatting errors, etc

When tested against a spam database this software correctly classified 99.95% of messages and removed 92% of spam! (0.05% of messages classified as spam were not spam; 92% of spams were classified as spam).

The 'spam score' is inserted into a header called 'X-Spam-score'. If the score is over 5, it's considered probable spam (99.95% likely). In that case, a header 'X-Spam: spam' is added, as well as a number of 'SPAM: ' headers, one describing each rule that was hit by the message and the weight of that rule.

To utilise these system, create a reject rule or a fileinto rule, look in 'advanced' and use the phrase:

Code:

header :contains ["X-Spam"] "spam"

Well, let me know how it goes. I've been playing with it and I've gotta say I'm thrilled. It chews up the CPU terribly however, so we'll only be making this available to Full and Enhanced accounts. Only Enhanced accounts have access to it at this stage while it's being tested.

nic76 · 1 Apr 2002, 10:50 PM

aha, will be made available to full users and possibility to redirect to a folder, cool!

Heartz · 2 Apr 2002, 12:01 AM

I'm pretty upset that it's only offered to full and enhanced members. Spam control is usually a default feature in most free services.

Would it be possible if members and even guest get some sort of a cut down version for spam control ?

nic76 · 2 Apr 2002, 12:39 AM

Quote:

Originally posted by Heartz
I'm pretty upset that it's only offered to full and enhanced members. Spam control is usually a default feature in most free services. Would it be possible if members and even guest get some sort of a cut down version for spam control ?

i guess the idea is that if you want any of the 'advanced' features, you'll have to upgrade
spam control (or something that claims to control spam) is perhaps offered for free at the so called 'free' mail providers, but they don't offer much of the other features of fastmail
anyhow, it's up to Jeremy and Rob to decide this, but i wouldn't count on it

**gpdoyon** · 2 Apr 2002, 01:42 AM

Okay Jeremy, I've implemented this new feature! I've never received any SPAM in my FastMail account, but, I suppose this will be a good check to make sure nothing is moved to my SPAM folder when it shouldn't be.

Thanks!

- Gerry

**circuit** · 2 Apr 2002, 01:46 AM

Quote:

Originally posted by Heartz
Would it be possible if members and even guest get some sort of a cut down version for spam control ?

Every time a new feature comes up, someone asks for a variation of that feature for all users. I think Jeremy and Rob are upfront about what will be available to who. If something is very CPU intensive, then it makes sense to only provide that feature to people who pay.

If FastMail gave everything to everyone, nobody would pay! It would be a matter of months before the system buckled under the strain. I was a Member up until a few days ago... then I switched to Full. I decided I really want some more aliases, and for my money I'll get spam control too - and I'm not committed after a year if I don't want to continue paying.

Their system of payment and privelidge works. If you need a feature that will make your life easier, just pay for it

Heartz · 2 Apr 2002, 03:51 AM

I agree with everything you say circuit but there no harm trying to ask Jeremy isn't there ?

A member account is more than enough for me right now. I have one spam alias which I will use around the internet and dump once spam starts creaping in. I keep my personal email address a closely guarded secret nowadays.

Ah well, I guess I'll just wait for the one remaining feature promised to members --> Virus Protection.

Jeremy Howard · 2 Apr 2002, 06:17 AM

Quote:

Originally posted by Heartz
I'm pretty upset that it's only offered to full and enhanced members. Spam control is usually a default feature in most free services.

We have spam control for free too. As you know, we have had filters in place for a while that trap a fair bit of spam. This is not changing.

However, SpamAssassin, which uses extremely resource intensive techniques to give a very high level of protection, is a premium feature, only provided to premium accounts.

famewolf · 2 Apr 2002, 07:54 AM

I'm perfectly happy with the level of spam control I get as a guest...between the blocking of open relays and the keyword filter I rarely see a spam get through..the only thing I would like to see is if we have a forwarding email address we could tell the parser to ignore "bigfoot.com" in the headers for instance and the "sender" would be the one before bigfoot.

Jeremy Howard · 2 Apr 2002, 08:29 AM

We don't mind full/enhanced users using our resources. They're paying for them after all. We'll just buy them more servers if we have to.

Jeremy Howard · 2 Apr 2002, 10:29 PM

I lied. It wasn't working for stuff collected through POP Links after all. I've fixed that now. That makes me happy, because my Hotmail link is scheduled for once a week, and normally when it kicks in my inbox is suddenly full of spam. No longer!

I also went through my junk mail folder on Hotmail and forwarded a few messages to myself to test SpamAssassin. They all got scores over 10, and the cutoff is only 5. So I've increased the cutoff to 6 now, which will actually cut down the false positives a fair bit.

It's fun looking at how spam gets scored. Most spam has so many indicators, particularly incorrectly formed messages (proving the golden rule: "spammers are stupid"). Here's an example of one I just picked up:

Code:

SPAM: 12 hits, 5 required;
SPAM: *  0.6 -- Subject has lots of exclamation marks
SPAM: *  2.5 -- Subject contains lots of white space
SPAM: *  1.0 -- Subject has an exclamation mark
SPAM: *  1.7 -- Message-Id is not valid, according to RFC-2822
SPAM: * -0.3 -- Message-Id has no @ sign
SPAM: *  0.4 -- BODY: Tells you how to stop further SPAM
SPAM: *  1.6 -- BODY: I wonder how many emails they sent in error...
SPAM: * -2.8 -- BODY: Contains a claim of copyright
SPAM: *  0.9 -- BODY: Asks you to click below
SPAM: *  2.5 -- BODY: Uses a numeric IP address in URL
SPAM: *  1.6 -- BODY: Tells you to click on a URL
SPAM: *  2.3 -- Missing To: header

**Shelded** · 2 Apr 2002, 11:38 PM

I suppose this is SpamAssassin's technique, not yours? After all, I would expect you keep your own methods secret.

jshumway · 3 Apr 2002, 01:30 AM

Any chance you could let us Full members in on the test since we will be getting these features once they are live? Both of the new features are awesome and I would love to help test the them.

Jeff

mlevin · 3 Apr 2002, 02:40 AM

Quote:

Originally posted by Jeremy Howard
To utilise these system, create a reject rule or a fileinto rule, look in 'advanced' and use the phrase:

Code:

header :contains ["X-Spam"] "spam"

Thanks for setting this up. I'm a little confused about setting this up. Here's what I did:

1. Went to preferences and checked "spam" (and "virus" -- cool!)
2. Went to "define rules" and clicked "advanced" and was just taken to the same screen.
3. Reread your instructions and made up some rule (subject = qwerty, file in "spam" folder).
4. Went to advanced, edited the text to match your code (pretty much).

But I noticed a few weird things.

1. My qwerty rule was still in the regular (non-advanced) screen, but didn't appear in the "advanced" screen -- are these things not related? I kind of assumed that one was just a more complex representation of the other. A rule can appear in one and not the other? Anyway, I went back into the "non-advanced" screen and deleted my dummy rule and went back into advanced and noticed that my X-Spam rule was still there.
2. The rule didn't seem to work very well. I sent a few test messages to myself with "this is spam" as the body and they didn't make it to my inbox OR spam folder -- they just disappeared, unless they are tied up in the queue somewhere...

Eventually, might you put a simpler interface on the spam engine (so that I could just create a "reject spam" or "file spam into folder <foldername>" right from the "non-advanced" gui?

Thanks

Jeremy Howard · 3 Apr 2002, 05:26 AM

Shelded: the scoring engine is SpamAssassin, so all the rules and the score for each is from them. The integration with the mail server is written by us.

Jshumway: This will be coming to full accounts very soon. I'd rather restrict the test to a smaller group for now however

MLevin: You don't use the 'View filter source' link. Use the normal rules screen, and in the 'Look in' popup, choose the 'Advanced' option, and type the criteria I posted above. The Rules screen does not show changes you make in the Source screen--you need to choose one or the other to maintain your rules and stick to it.

1 Apr 2002, 10:47 PM	#1
Jeremy Howard Ultimate Contributor Join Date: Sep 2001 Location: Australia Posts: 11,501	Experimental Anti-spam OK brace yourself. This is so cool... I've installed SpamAssassin on FastMail.FM. At this stage it is only available for testing by Enhanced subscribers. Click 'Spam protection' on the Preferences screen. It creates a 'spam score'. It works on all messages, even stuff collected through POP/Hotmail links! The score uses these rules. To summarise the main rule types: Razor: Creates a checksum of the message and compares it to recently reported spam in a global database; if they match, it's spam! DNSBL: Check all servers in the SMTP path for open relays, open proxies, and blacklisted hosts in many blacklists, each one weighted differently depending on past results Header and body checks: Various checks for common spam phrases like "This is not spam!" and "This is sent in compliance with bill S1618" Structure: Checks whether it's HTML mail, has an embedded form, contains formatting errors, etc When tested against a spam database this software correctly classified 99.95% of messages and removed 92% of spam! (0.05% of messages classified as spam were not spam; 92% of spams were classified as spam). The 'spam score' is inserted into a header called 'X-Spam-score'. If the score is over 5, it's considered probable spam (99.95% likely). In that case, a header 'X-Spam: spam' is added, as well as a number of 'SPAM: ' headers, one describing each rule that was hit by the message and the weight of that rule. To utilise these system, create a reject rule or a fileinto rule, look in 'advanced' and use the phrase: Code: header :contains ["X-Spam"] "spam" Well, let me know how it goes. I've been playing with it and I've gotta say I'm thrilled. It chews up the CPU terribly however, so we'll only be making this available to Full and Enhanced accounts. Only Enhanced accounts have access to it at this stage while it's being tested.

2 Apr 2002, 07:54 AM	#9
famewolf Member Join Date: Mar 2002 Posts: 41	spam control for guests I'm perfectly happy with the level of spam control I get as a guest...between the blocking of open relays and the keyword filter I rarely see a spam get through..the only thing I would like to see is if we have a forwarding email address we could tell the parser to ignore "bigfoot.com" in the headers for instance and the "sender" would be the one before bigfoot.

2 Apr 2002, 10:29 PM	#11
Jeremy Howard Ultimate Contributor Join Date: Sep 2001 Location: Australia Posts: 11,501	I lied. It wasn't working for stuff collected through POP Links after all. I've fixed that now. That makes me happy, because my Hotmail link is scheduled for once a week, and normally when it kicks in my inbox is suddenly full of spam. No longer! I also went through my junk mail folder on Hotmail and forwarded a few messages to myself to test SpamAssassin. They all got scores over 10, and the cutoff is only 5. So I've increased the cutoff to 6 now, which will actually cut down the false positives a fair bit. It's fun looking at how spam gets scored. Most spam has so many indicators, particularly incorrectly formed messages (proving the golden rule: "spammers are stupid"). Here's an example of one I just picked up: Code: SPAM: 12 hits, 5 required; SPAM: * 0.6 -- Subject has lots of exclamation marks SPAM: * 2.5 -- Subject contains lots of white space SPAM: * 1.0 -- Subject has an exclamation mark SPAM: * 1.7 -- Message-Id is not valid, according to RFC-2822 SPAM: * -0.3 -- Message-Id has no @ sign SPAM: * 0.4 -- BODY: Tells you how to stop further SPAM SPAM: * 1.6 -- BODY: I wonder how many emails they sent in error... SPAM: * -2.8 -- BODY: Contains a claim of copyright SPAM: * 0.9 -- BODY: Asks you to click below SPAM: * 2.5 -- BODY: Uses a numeric IP address in URL SPAM: * 1.6 -- BODY: Tells you to click on a URL SPAM: * 2.3 -- Missing To: header

1 Apr 2002, 10:50 PM	#2
nic76 Essential Contributor Join Date: Nov 2001 Posts: 449	aha, will be made available to full users and possibility to redirect to a folder, cool!

2 Apr 2002, 12:01 AM	#3
Heartz Essential Contributor Join Date: Feb 2002 Location: Selangor, Malaysia Posts: 460	I'm pretty upset that it's only offered to full and enhanced members. Spam control is usually a default feature in most free services. Would it be possible if members and even guest get some sort of a cut down version for spam control ?

2 Apr 2002, 01:42 AM	#5
gpdoyon Moderator Join Date: Jan 2002 Location: Westbrook, Maine USA Posts: 462	Okay Jeremy, I've implemented this new feature! I've never received any SPAM in my FastMail account, but, I suppose this will be a good check to make sure nothing is moved to my SPAM folder when it shouldn't be. Thanks! - Gerry

2 Apr 2002, 03:51 AM	#7
Heartz Essential Contributor Join Date: Feb 2002 Location: Selangor, Malaysia Posts: 460	I agree with everything you say circuit but there no harm trying to ask Jeremy isn't there ? A member account is more than enough for me right now. I have one spam alias which I will use around the internet and dump once spam starts creaping in. I keep my personal email address a closely guarded secret nowadays. Ah well, I guess I'll just wait for the one remaining feature promised to members --> Virus Protection.

2 Apr 2002, 08:29 AM	#10
Jeremy Howard Ultimate Contributor Join Date: Sep 2001 Location: Australia Posts: 11,501	We don't mind full/enhanced users using our resources. They're paying for them after all. We'll just buy them more servers if we have to.

2 Apr 2002, 11:38 PM	#12
Shelded Moderator Join Date: Aug 2001 Location: USA Northwest Posts: 3,849	I suppose this is SpamAssassin's technique, not yours? After all, I would expect you keep your own methods secret.

3 Apr 2002, 01:30 AM	#13
jshumway Junior Member Join Date: Mar 2002 Location: Centerville, OH Posts: 25	Any chance you could let us Full members in on the test since we will be getting these features once they are live? Both of the new features are awesome and I would love to help test the them. Jeff

3 Apr 2002, 05:26 AM	#15
Jeremy Howard Ultimate Contributor Join Date: Sep 2001 Location: Australia Posts: 11,501	Shelded: the scoring engine is SpamAssassin, so all the rules and the score for each is from them. The integration with the mail server is written by us. Jshumway: This will be coming to full accounts very soon. I'd rather restrict the test to a smaller group for now however MLevin: You don't use the 'View filter source' link. Use the normal rules screen, and in the 'Look in' popup, choose the 'Advanced' option, and type the criteria I posted above. The Rules screen does not show changes you make in the Source screen--you need to choose one or the other to maintain your rules and stick to it.