paul_venezia
Senior Contributing Editor

Should have done this last week

analysis
Aug 26, 20032 mins

Finally got some time to drop a simple SoBig.F filter on blues. In 20 minutes, 225 emails were rejected. This is by no means pretty, since blues doesn't have the horsepower to handle real virus scanning. All I did was insert a new local rule that errors mail with subject lines that match known SoBig.F and klez subject lines. Obviously, it's needed, since blues handles quite a bit of email: Statistics from Thu Au

Finally got some time to drop a simple SoBig.F filter on blues. In 20 minutes, 225 emails were rejected.

This is by no means pretty, since blues doesn’t have the horsepower to handle real virus scanning. All I did was insert a new local rule that errors mail with subject lines that match known SoBig.F and klez subject lines. Obviously, it’s needed, since blues handles quite a bit of email:

<blockquote>Statistics from Thu Aug 21 14:00:00 2003
 M   msgsfr  bytes_from   msgsto    bytes_to  msgsrej msgsdis  Mailer
 0        0          0K     5715      13191K        0       0  prog
 3     9734     342303K     7190      15051K        9       0  local
 5    61706    5100242K    53740      13815K     3022       0  esmtp
=============================================================
 T    71440    5442545K    66645      42057K     3031       0
 C    96248                62016                14585
</blockquote>

The problem is that until I remove the filters, selected email subjects are verboten, regardless of content. Much like AOL blocking IP ranges.

The true threat of spam isn’t full inboxes or wasted bandwidth, although these are significant problems, it’s the fact that spam and email-borne viruses are rendering an open communications infrastructure into swiss cheese, where no connection can be relied upon due to legacy blacklists.

Too many IP ranges are blocked since they’re IANA reserved… when they open those blocks, they’re all but useless. It’s bothering me greatly these days. It doesn’t have to be this way, it doesn’t have to be this hard. Why do we continue to do these things? Perhaps it really is time to move away from SMTP. That, of course, might be worse than fighting this war.

It’s now been 30 minutes since I put the filters in place. 350 viruses blocked.