[antispam-f] Re: Recent Spam
- From: Jeremy Nicoll - freelists <jn.flists.73@xxxxxxxxxxxxxxxxxxxx>
- To: antispam@xxxxxxxxxxxxx
- Date: Thu, 29 Nov 2007 22:33:11 +0000
Dave Barnett <as10@xxxxxxxxxxxxxxxxx> wrote:
> In a recent message Jeremy Nicoll - freelists
> <jn.flists.73@xxxxxxxxxxxxxxxxxxxx> wrote:
>
> > What? How can that be related to the format of an email address?
>
> I added a P.S. correcting the time to -0500.
Yes, but so what?
> I You have any contact with the ex-colonies of North America, you will
> know that they expect names to be <first> <initial>. <last>.
They don't have a monopoly on name formats in the US. Anyone anywhere who
happens to want to set their name to something like "Fred F. Bloggs" will
likely do it in that form. Try looking at your genuine mails and sort on
their TO: value and you'll find some, well you might not if you've deleted
such mails for other spurious reasons.
What about people in other time zones and/or those with their time zones set
slightly wrong?
> > But it's perfectly legitimate that you receive an email that's eg:
> >
> > To: someone-else
> > BCC: you
> >
> As the To: used is always is of the form fakename@mydomain , I think
> that the risk is vanishingly small. Perhaps if I extend the rule to
> Envelope-To: that will reduce the risk further.
>
> > in which case there will be nothing in the To: line (and nothing
> > necessarily in any other header) that contains your real name. Many
> > mail lists work that way, which may be ok if they're all actively looked
> > for by ACCEPT rules.
>
> As I do near the top of my rules.
If you get any mails fromcorproate emals systems they may also use BCC.
Certainly I used to, a lot, when I sent mails anywhere from work.
> > There's no doubt it will delete things, but that's not a reliable test
> > of whether it deletes the right things. It may delete lots of garbage,
> > but then also delete genuine mail to you. How would you know?
> >
> I wouldn't, unless I picked over the log.
Goodness, do you mean you don't check the log after every run?
I do, though the StrongED stuff I described in another reply was
specifically written to make that checking process as untedious as possible.
> That argument also applies if you let your ISP do the deleting.
Yes, which is why I don't.
--
Jeremy Nicoll - my opinions are my own
Other related posts:
