[FQuest Announce] SpamAssassin Upgrade

[Deb]

When: Mon, Nov 24, 2003
Duration: 5 - 30 minutes: only affecting users of SpamAssassin
Window: 12:00 AM to 3:00 AM EDT

Due to the nature of the SpamAssassin software, it becomes less effective over time, as spammers change the characteristics of their email. Therefore, in order to check for the new types of email techniques that the spammers use it is necessary to upgrade to a new version of SpamAssassin. Thus, the upgrade is now scheduled :)

The current version of SpamAssassin running on the FutureQuest servers is 2.55. FutureQuest will be upgrading to the latest version, which is 2.60. This upgrade does not include any major interface or configuration changes.

Delivery of some inbound emails, which require scanning by SpamAssassin, may be briefly delayed All other email services, including the sending of outbound email and delivery of inbound email, which does not require scanning by SpamAssassin, will be unaffected.

If you do not have SpamAssassin configured to Delete tagged messages no email should be lost during this upgrade. As a result of the delivery mechanism, however, there is a potential for email loss if SpamAssassin is set to delete tagged messages.

NOTE: FutureQuest is unable to recover any email that is deleted or bounced as a result of email filters.

IMPORTANT IMPORTANT IMPORTANT
It is likely that the new version will assign different scores to your incoming email than the current version does. Therefore, if you have your email currently set to delete, you may wish to visit your CNC now and change this to some other action, or temporarily raise the Required Hits Score, to protect yourself against losing email. Once you have monitored the behavior of the upgraded version, and feel confident with your scoring choices, then you could set it to delete tagged messages once again.

Deb
- And you guys thought we were done...pffttt 8}

[LightGuide]

Oh, goodie!

[Squirrel]

Bring it on. I have a passionate dislike for spam.

[kitchin]

It's tonight. I plan to go through and temporarily change my SA "delete" settings where I use them...

[Bruce]

The upgrade to SpamAssassin 2.60 is complete. Messages are now being scanned by all new rules, and mail appears to be flowing normally.

In response to http://www.aota.net/forums/showthread.php?postid=100882#post100882 FutureQuest has implemented a size restriction of 500 KB for any messages for SA. Any message that is greater than 500 KB in size will no longer be scanned in order to ensure that large messages do not unduly affect the processing of normal mail.

[farlane]

Thanks!

Spam penetration way down!

[dank]

Seemed quite a bit lower for me this morning, too.

Dan

[Randall]

Any message that is greater than 500 KB in size will no longer be scanned in order to ensure that large messages do not unduly affect the processing of normal mail. That makes sense -- anyone who's blasting out millions of emails at a time wouldn't be attaching huge files to them. It would just slow things down and make them that much more conspicuous. And the executable filter will kill any overweight viruses.

The thought of a 500K virus probably keeps Terra awake at night. ;)

Randall

[Chipmunk]

You're giving spammers too much credit for potential intelligence. A company claiming to be a Costco in Alaska sent a 563,200 byte (physical size - 767,076 transmission size) catalog of some sort to a non-existent account on our domain. They've sent at least two more spams since then, all from the :-( same ISP, and all promptly reported thru SpamCop.

American "open" spammers are my latest pet peeve.

[Randall]

OK, I'll rephrase that -- no spammer would do that for very long before they got clobbered, and the ones we're most concerned about aren't mailing out Costco catalogs. ;)

Randall

[Chipmunk]

For those of us on :-( dialup connections, one 750 KB file is equal to about 150 single spams.

What is particularly disturbing is that after the first spam, I promptly chunked it thru SpamCop, and emailed a direct complaint to the ISP with a cc to the FTC. Over the next month we received two more spams from the exact same email address and using the same email server.

The words of the ISP's abuse policy are better than most (one strike and you're out), but the implementation was zilch. As far as I can tell, it wasn't an open relay, so I had expected to receive a personal response from the ISP confirming termination of Costco's account. Or, as you :-) elegantly put it, that they'd been "clobbered".

This isn't the only instance of what I think of as "open" spammers. Travelocity was using IronPort's Bonded Sender for a while, and were still spamming us (we at least three times used their opt-out, plus had put the victim address on the DMA's opt-out list).

Sorry, I got into a :-) bit of a vent there, eh?

Oh, and excellent decision FQ to put in that size "fail thru"!