CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

$9736.22 of $21422.68
left sidedonated so farneed $11686.46 donated to reach our goalright side, our goal
Help CastleCops serve the community on new servers, Donate Here to reach our goal.

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
Survey
spacer
Was 2007 a good year?

Yes it was a wonderful year
Yes, but there is always room for improvement
Status quo
It was a challenge
Other (leave comment)



Results
Polls

Votes: 934
Comments: 25
block bottom
spacer spacer

Blacklist - Whitelist management
Goto page 1, 2  Next
 
Post new topic   Reply to topic       All -> FavForums -> Product Suggestions [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
darkroomdevil

Trooper
Trooper


Joined: May 04, 2007
Posts: 12
Location: USA

PostPosted: Fri May 04, 2007 3:04 pm    Post subject: Blacklist - Whitelist management
Reply with quote

Hi, I am a heavy regular user of mailwasher, I love it

The problem I am having is that I have a business that receives random email that is legitimate from some domains that I would otherwise blacklist because they receive a lot of spam - so I have to skim all emails regardless.

-I don't want to miss legitamate customers email
-blacklist searching - management is too slow and clumsy to check for legitimate customers though the lists

I would highly reccomend a seperate program/module accessed from mailwasher for doing all of the whitelist blacklist filter management stuff, probably to include;

-searching, filtering, sorting
-turn a set of email addresses into a domain filter
-statistical analisys
-viewing the most recent email body stored in the database connected to the selected email
-being able to work on a set of emails in one step by selecting a group of them or filtering and working on all that are visible
-search function could also include the body text stored in the database

I realise this can be a real paradigm shift to a much more proactive management - but for me, it is either something like this or a email verification system which I would rather not make the customers go through.

If anyone has suggestions how I might better utilize Mailwasher in its current version , it would be much appreciated Smile

-Roger

Back to top
View users profile Send private message
stan_qaz

Premium Member


Joined: Mar 31, 2003
Posts: 10579

Premium

PostPosted: Fri May 04, 2007 7:59 pm    Post subject:
Reply with quote

Forget the MW marketing spiel.

Remember one really basic fact:

BLACKLISTING does not blacklist the source of the spam!

All the blacklist does is add the e-mail address that the spammer chose to forge into the message header to a list of addresses that MW will show as blacklisted.

Spammers know that people spend endless hours adding their forged addresses to blacklists and waiting while anti-spam programs churn through thousands and thousands of forged addresses looking for a match.

Spammers are not stupid, they use fresh addressed for almost every spam run so that the blacklisters can happily blacklist the forged address without bothering the spammer who will never use it again. Sometimes just for fun they will use a real address... just not one of theirs, they pick some innocent third party.

Spammers have a sense of humor, if they can get you to blacklist a bunch of innocent folks just by stealing their addresses they get hours of chuckles for free.

Hopefully you are beginning to see a pattern here -- blacklisting doesn't work as advertised. It is not alone in being pumped by anti-spam marketers selling to the gullible and uneducated, look at the wiki article on bouncing for a real marketing scam.

Blacklisting does have one small redeeming quality BUT ONLY if you use it properly. If you get several spam messages from the same address on each spam run, either to one account or to multiple accounts - blacklisting will tie them together and let you mark them all with one click. For this to be effective you need to keep the blacklist retention very short, 3 days is more than long enough, anything more just helps the spammers disrupt normal e-mail traffic. I don't bother, the learning tool is much more effective and much harder for the spammers to fool.

There is a very good getting started with MW article in the wiki that is pretty much what I use even now, it hasn't missed a spam or tagged a good message in some time.

To effectively use MW you need: a good friends list, to setup and use the learning tool option and a couple simple filters for protecting recycled messages and ones from yourself. That's it nothing more is really needed.

You can go beyond the basics if you find something that MW is missing time after time even if you have trained it but only a small fraction of users need to go that far.


Bottom Line: Yes the MW marketing weasels lied to you about the effectiveness of some of the "features" of MW but once you get over being ticked off at that the remaining features work very well and MW is still the best anti-spam product I've found.


_________________
Questions? Try the wiki
http://wiki.castlecops.com/MailWasher_Pro
Back to top
View users profile Send private message
AlphaCentauri

SIRT Handler
Premium Member

Joined: Nov 20, 2003
Posts: 2626

Premium

PostPosted: Sat May 05, 2007 3:22 am    Post subject:
Reply with quote

If you REALLY want to blacklist, you have to create a mailwasher filter that blocks IP numbers in the header. There are a few blocks of IP numbers that are responsible for massive amounts of spam, and you can create filters that will sort for those. If you don't get a lot of mail from Asia or Russia, it may be a useful filter for you, though it will make it take a lot longer to filter your mail.

That being said, spammers no longer send spam from their own email accounts, even with forged headers. They put malware on other people's computers ("botnets") that allow them to commandeer them to send the spam a few messages at a time from each computer to avoid notice. Still, since that system relies on infecting users who may have outdated or pirated versions of Windows or antivirus programs, there will still be more of them in IP ranges from countries with weak intellectual property enforcement.

Back to top
View users profile Send private message
darkroomdevil

Trooper
Trooper


Joined: May 04, 2007
Posts: 12
Location: USA

PostPosted: Sat May 05, 2007 5:35 am    Post subject:
Reply with quote

WOW

Thanks for the straight talk

If I hop on to this conceptual band wagon, from the MW pint of view, are you implying that we would be rogue? In other words, is this embrassed or endorsed by MailWasher at all? ... I am not saying that that would be good or bad, I am sure there is more than one way to view these truths even for those that are in complete agreement as to the facts.

I will go look at the wiki - and thanks! - but my problem is still that I don't want to comb though all of the emails that are bad - since it is not guarenteed at 100% (what is ... ), it seems I will still need to do this no mater what system is used. I will go read the wiki, if I get any ideas I will post back ... Wink

Thanks!
-Roger

Back to top
View users profile Send private message
AlphaCentauri

SIRT Handler
Premium Member

Joined: Nov 20, 2003
Posts: 2626

Premium

PostPosted: Sat May 05, 2007 3:24 pm    Post subject:
Reply with quote

If you are willing to lose some emails, your ISP probably can provide pretty good spam filtering for you. MWP is for people who are not willing to tolerate "false positives" and want a way to retain complete control of what gets deleted yet protect themselves from some of the malware that might be released by opening email on a full function email program.

But I'm not sure why you think it is "rogue." The spammers are the ones doing things illegally. We're trying to keep on top of their latest permutations to maintain our ability to see our email without wading through all the spam.

Back to top
View users profile Send private message
stan_qaz

Premium Member


Joined: Mar 31, 2003
Posts: 10579

Premium

PostPosted: Sat May 05, 2007 7:40 pm    Post subject:
Reply with quote

I really do very little looking at my mail, just a quick scan to see what is in the inbox and mark anything that is a new friend or was missed by learning (few are) and hit process.

The wiki will give you plenty on bouncing, it is a very bad thing.

Blacklisting isn't bad other than being a nearly complete waste of your time.

The firetrust position is pretty simple, the boss wants bouncing to stay, the workers get input but he decides.


_________________
Questions? Try the wiki
http://wiki.castlecops.com/MailWasher_Pro
Back to top
View users profile Send private message
darkroomdevil

Trooper
Trooper


Joined: May 04, 2007
Posts: 12
Location: USA

PostPosted: Sun May 06, 2007 4:15 am    Post subject:
Reply with quote

Alpha and Stan - Thanks for the replies!

Alpha - OK, Rogue was a little toungue and cheek - I really did mean what I said after: "In other words, is this embrassed or endorsed by MailWasher at all?" And by that I meant the attitudes about bouncing, blacklist management and the implications that those parts of the program are included for marketing/sales reasons only, but my opinion is way toned down - giving respect to the idea that they do need to sell the product to stay in business and that they may really arrive at a different slant on the ideas with the same set of facts.

I am one of those that won't tolerate 'false positives' being lost bu my isp ...

stan - Thanks for the heads up on the Firetrust position, I really do understand.

-Roger

Back to top
View users profile Send private message
AlphaCentauri

SIRT Handler
Premium Member

Joined: Nov 20, 2003
Posts: 2626

Premium

PostPosted: Sun May 06, 2007 4:41 am    Post subject:
Reply with quote

I don't get too upset by what appears to be false advertising. There is a steady stream of new users that come here with questions about bouncing. They found Mailwasher because they all got the same bright idea we did, which is that if the spammer thought our email address no longer was in use, they would remove us from their email lists just the way we remove people from our email lists when our mail to them bounces.

And initially, that was the way it worked, back when spam had real return email addresses and spammers paid for their own internet access to send their spam. It doesn't anymore, but we're all still using Mailwasher because it's a great product. The only product that actually got spammers to remove names from their lists was BlueFrog (which Mailwasher interacted with); search the forums to find out how spammers reacted to that bit of success.

Back to top
View users profile Send private message
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16505

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Sun May 06, 2007 2:50 pm    Post subject:
Reply with quote

stan_qaz wrote:
The firetrust position is pretty simple, the boss wants bouncing to stay, the workers get input but he decides.

Not according to the info I have. About a year ago Tembow got confirmation directly from Nick that the bounce feature is antiquated. Recently I had the opportunity to provide feedback about the new site layout so I laid out the case for removing any promotion of the bounce feature that alluded to reduction of spam. I received a personal reply from Nick that this would be corrected. So I don't understand why, for example, the following hasn't been fixed yet:
The author of the FireTrust MailWasher Pro product description wrote:
Bounce back unwanted email to the spammer so it looks as if your email address is not valid.

It would seem that someone isn't listening to the boss. Confused


_________________
imageCastleCopsWiki
Back to top
View users profile Send private message
stan_qaz

Premium Member


Joined: Mar 31, 2003
Posts: 10579

Premium

PostPosted: Mon May 07, 2007 4:27 am    Post subject:
Reply with quote

Perhaps the boss says different things to different people.

Removing the bounce feature from the promotional stuff is a few minute operation.

Removing it from the program would be a bit more difficult but it could be done.

When I see a change I'll believe it, until then... Sad


_________________
Questions? Try the wiki
http://wiki.castlecops.com/MailWasher_Pro
Back to top
View users profile Send private message
darkroomdevil

Trooper
Trooper


Joined: May 04, 2007
Posts: 12
Location: USA

PostPosted: Mon May 07, 2007 4:16 pm    Post subject:
Reply with quote

What I have done so far;

- Emptied the blacklist, it is now for legitimate mail sources that I no longer want to receive mail from.

- Sort by Source, I don't have to keep checking the delete and friends status as I go (I used to sort by subject so the emails would not change their order as I went - but now I am not changing emails to blacklist so that is no longer a real problem)

- Use the down arrow key and the d key instead of the delete key to mark an email for deletion, less of a keyboard dance Smile

If I figure any other workflow things out I will post.

Stan and Alpha - The MW bouncing issue is a hard one, if the feature brings in new customers ... I can see MW not advertising it's uselessness on their site if they want to sell their program - but they do link to this forum where the info is available. Some will buy the program because of the feature list and never utilize bouncing after a few bouncing bounce backs or whatever ... others will love it for it and I do't think that will cause any real harm ... most of the casual users, I think, will ignore it and love the program for what it does best ... Smile

-Roger

Back to top
View users profile Send private message
stan_qaz

Premium Member


Joined: Mar 31, 2003
Posts: 10579

Premium

PostPosted: Tue May 08, 2007 4:16 am    Post subject:
Reply with quote

Getting reported to your ISP for mail forgery/abuse isn't a minor problem for many folks. The better ISPs are now detecting forged outgoing headers and attempting to block them.

Having a bunch of the Anti-Spam folks refusing to recommend your program because the bounce is a bad thing really hurts sales. I've gotten so tired of getting hammered about it that I always post the bounce problems in any recommendation for MW which really is a turn off for prospective buyers.

I sort on one of two fields. If I'm not planning on processing mail for a while, the Arrived Time of the message - that puts the new mail at the top of the list where it is easy to see. If I'm actually working with the mail I sort on the Status so the like stuff is grouped and I can "block select" and tick stuff with less effort and clicking.


_________________
Questions? Try the wiki
http://wiki.castlecops.com/MailWasher_Pro
Back to top
View users profile Send private message
darkroomdevil

Trooper
Trooper


Joined: May 04, 2007
Posts: 12
Location: USA

PostPosted: Tue May 08, 2007 5:50 am    Post subject:
Reply with quote

stan_qaz wrote:
Getting reported to your ISP for mail forgery/abuse isn't a minor problem for many folks.


This implies an understanding of a situation that I am not familiar with ... do you mean that if a spammer forged my name, my ISP might beleive that it really came from me and punish me instead of realizing that it could be forged? Are the ISPs not savvy in their own industry?

stan_qaz wrote:
The better ISPs are now detecting forged outgoing headers and attempting to block them.


cool

stan_qaz wrote:
Having a bunch of the Anti-Spam folks refusing to recommend your program because the bounce is a bad thing really hurts sales. I've gotten so tired of getting hammered about it that I always post the bounce problems in any recommendation for MW which really is a turn off for prospective buyers.


So by bringing it up you take the wind out of their sails ... proactive instead of defensive? - OK

There is always going to br a few 'perfect people' that have a problem with something no matter what you do ... or just regular folks with strong opinions. Either way you can also take some of the wind out of the sails by just agreeing - the more discussion there is the more importance you are giving - and in reality it is just one facet of a great program. In most everything there is something that can be improved - and one persons improvement is going to anothers complaint ...

stan_qaz wrote:
I sort on one of two fields. If I'm not planning on processing mail for a while, the Arrived Time of the message - that puts the new mail at the top of the list where it is easy to see. If I'm actually working with the mail I sort on the Status so the like stuff is grouped and I can "block select" and tick stuff with less effort and clicking.


Wow - THANK YOU - I didn't realise I could block select, tick one and all selected would update. So the new technique with this info;

- sort by Status
- highlight first row
- hold down shift key while hitting down arrow until I get to the end of the bad boys to select them all and review at the same time
- one click on a delete checkbox within any that are selected ... yeah!

I feel silly being excited about this, but add each technique together and it starts to make a real difference for me Smile

-Roger

Back to top
View users profile Send private message
stan_qaz

Premium Member


Joined: Mar 31, 2003
Posts: 10579

Premium

PostPosted: Tue May 08, 2007 6:22 am    Post subject:
Reply with quote

Quote:
This implies an understanding of a situation that I am not familiar with ... do you mean that if a spammer forged my name, my ISP might beleive that it really came from me and punish me instead of realizing that it could be forged? Are the ISPs not savvy in their own industry?


Has nothing to do with a spammer, only the action you take: faking a bounce to an address that you have no way to prove is associated with sending the spam.

A bounce generated by MW is a mail forgery, you are faking the header and sending a fake bounce to the address the spammer wants it to go to. Not to the spammer

My ISP and many others call that abuse and will close your account if you keep it up.

You stand a decent chance of being reported to spamcop.net and getting your ISPs mail server blacklisted and cause all their customers mail delivery problems if you bounce mail to a stolen e-mail address.

You could even bounce to me and end up here:

http://www.stanmiller.info/pages/clueless.html

It has nothing to do with someone else using your text e-mail address, that is a completely different issue.

The ISP can easily see that they didn't send the fake bounce and track it back to your IP address. Given the grief it can cause them they are often not amused by this type of thing.


_________________
Questions? Try the wiki
http://wiki.castlecops.com/MailWasher_Pro
Back to top
View users profile Send private message
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16505

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Tue May 08, 2007 6:24 am    Post subject:
Reply with quote

darkroomdevil wrote:
Stan and Alpha - The MW bouncing issue is a hard one, if the feature brings in new customers ... I can see MW not advertising it's uselessness on their site if they want to sell their program - but they do link to this forum where the info is available. Some will buy the program because of the feature list and never utilize bouncing after a few bouncing bounce backs or whatever ... others will love it for it and I do't think that will cause any real harm ... most of the casual users, I think, will ignore it and love the program for what it does best ... Smile

If someone buys MWP for the supposed benefits of the bounce feature (and many have based on comments made at these forums), at best it's misleading, thus false advertising.

Also, define "real harm". Imagine your email address being set as the "Return-Path" address in a spam mailout. I don't think you'll consider the fallout as a mere minor inconvenience.

For those of us who help others deal with real MWP problems, this false "official" info is a real PITA because of the number of times new users come here with bounce problems. One of the reasons I kept bugging Paul for a wiki was to mitigate this situation. FireTrust action to correct the problem at it's source is long overdue .


_________________
imageCastleCopsWiki
Back to top
View users profile Send private message
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Product Suggestions All times are GMT
Goto page 1, 2  Next
Page 1 of 2

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer