[Mimedefang] Blocking tiny messages -- [extension: Filtering Big Messages]

[renaud pascal]

Le mardi 5 décembre 2006 11:52, Kees Theunissen a écrit :
> On Tue, 5 Dec 2006, Kenneth Porter wrote:
> 
> > Given the recent run of messages that contain just a short number, I'm inclined
> > to reject any message that contains a body of less than 20-40 bytes as being a
> > nuisance. Does anyone have a piece of code that does that? (I'll copy it to the
> > wiki.)
> >
> > I can white-list people who are expected to send one-word test messages.

  That's sustainable only if the domain you admin is very stable and
technical (and probably not very populated), if your users may use
their email for real-life you'll get in trouble "as fas as you can't" ;D)

> 
> Be prepared to false positives. Not all messages with a very small body
> are spam or test messages.
> 
> How about a message with a subject of "Re: Meeting at 11.00 in the
> meeting room." and a body with just "I'll be there."?
> This body is well below 20 bytes.

  Not if the "poster" is using an MS "tool" wich would double encode
this in 1 part of text garbled with Quoted-Unusable and add a wannabe HTML
copy of it while taking bets on chances it will do it in the TNEF.DAT
way or use the new kooool stochastic paragraph tag appearance style ...
  Then it'll probably escape the SA filter for being over 100 KB ;-)

  Anyway, two small points :
  - somebody using the pseudo header Subject as the only test part
	deserves to a direct 571 and in case he doesn't get it he'll
	better be ignored and get no reply :-)

  - The Subject: is a part of data, not in the headers ;D)

  Now, keep cool, I switch the "spamcop mode" <OFF> aaah, that's better ;D)

  I do agree with you that an automatic reject for being terse would be
an abuse !
  Kenneth, think about adding some points to the global score but
don't just reject !

   Anyway, the terse spams are not much a big problem, if only all
spammers could be nice enough to make body-parts using less characters
than what my taggings are going to add to the headers :-)

  I'm much more poisoned with having to raise up the size
limit for using the SA filters, some recent spams I caught were around
200 - 300 KB (jpegs or gifs), next month I expect the spammers to
get the PHBs fever and send 10 MB Bowelpoint((c)(TM)(R)) spams ???