[antispam-f] Re: Lists inconsistancies

  • From: Frank de Bruijn <antispam@xxxxxxxxxx>
  • To: antispam@xxxxxxxxxxxxx
  • Date: Mon, 04 Dec 2006 19:43:38 +0100

In article <300fe38f4e.Dave@xxxxxxxxxxxxxxxxxxxxxxxxx>,
   Dave Barnett <as10@xxxxxxxxxxxxxxxxx> wrote:
> In a recent message Frank de Bruijn <antispam@xxxxxxxxxx> wrote:
> > In article <6cd3878f4e.Dave@xxxxxxxxxxxxxxxxxxxxxxxxx>,
> >    Dave Barnett <as10@xxxxxxxxxxxxxxxxx> wrote:

 [snip]

> >> Being a little cautious to start with, I set a Lists rule (say
> >> AcceptFrom) ahead of a group of (Accept) rules and waited for some
> >> hits.  After the first few hits, I then REMed the group of accept
> >> rules and felt pleased and set a few more lists.  Too soon.  Some
> >> AcceptFrom entries started to end up as defaults.  Hurriedly removing
> >> the REMs, I read TFM again.   By this time I'd set up DeleteFrom and
> >> Delete Subject lists which also only worked for a few entries.
> >
> > ?

> That was my reaction, it works for some but not the rest.  Couldn't
> see differences.

Strange.

> >> As the 'good' list entries seem to be near the top of the list, I
> >> wonder if there is some unrecognised limit or syntax.
> >
> > Not really. Size of the WimpSlot.

> I've just doubled it (now 640k) to try, will let you know.

Sorry, I meant to say that only the maximum size of the WimpSlot (i.e.
28M for RISC OS 4) limits the size of the lists. The program loads them
above HIMEM and expands the slot if necessary. BASIC can only use the
bit below HIMEM but that's usually large enough.

> >> Syntax was a problem when I tried to introduce a delete list based on
> >> Envelope-To: , AS crashed and left the iconbar leaving the rules file
> >> open.
> >
> > What was the error message (should be in the application log)?

 [replaced the Alt+140 in the text below with ... to avoid the mess]
 [caused by FreeList's less than useful interpretation of quoted   ]
 [printable...                                                     ]

> It was there but seems to have disappeared off the top of the window.
> IRRC was something simple like syntax error with a line number, but I
> suffer from CRAFT ;-(   It seemed to be associated with a rule Delete
> Envelope-To: ... and List DeleteEnvelope-To.  Killing the rule cured
> things, I assumed it was the '-' that was the problem.   I am now
> using Delete Envelope-To: ... Envelope and file Envelope, which is
> working (13 entries, most seem to be working).

> The list that was failing most was an attempt to kill the bounces that
> come to me as a result of faked 'From:'s that use my domain (e.g.
> abcdef@xxxxxxxxxxxxxxxxx , I'll have to filter that now).  I am trying
> to use Delete Subject: ... Bounce, with all the "Undelivered Mail"
> type of subject in a Bounce List.

That will also kill any real bounce messages...

I have a 'negative list' rule (Delete Recipient !... Alias) with all the
aliasses I use with my domains in the file 'Alias'. It gets rid of all
the crazy combinations and some 'contaminated' aliasses I no longer use.

The older Delete From: ... and To: ... are still there. The DeleteFrom
list is quite big and still catches a respectable number of 'known
spammers'.
Initially, I expected to be able to 'retire' the DeleteTo list, but I
found that a lot of mail that arrived with an invalid (but not mangled)
To header actually had a valid recipient, so the Recipient rule didn't
catch it.

Of course there's also a Delete Subject: ... with a list of 'known spam
words'.

Before all that I have a couple of Accept From: ... and To: ... rules to
accept mailing list addresses and the like, mainly because one of my
providers doesn't always include the information to (reliably) determine
what the recipient from the SMTP envelope was.

Finally a few 'old style' rules for some special circumstances and the
user test 'subj' (see the UserTests file in Default).

All in all no more than 17 rules.

> Once it gets to the third or fourth entry it seems to give up and go
> back to the main rules file (which still has my collection of bounce
> subjects).

Very strange.

If you want, I can have a look to try to figure out what goes wrong
here. I'll need all the relevant files (rules, lists, settings, logs
etc.).

Regards,
Frank

Other related posts: