| View previous topic :: View next topic |
| Author |
Message |
darkroomdevil
Trooper

 Joined: May 04, 2007 Posts: 12 Location: USA
|
Posted: Fri May 04, 2007 3:04 pm Post subject: Blacklist - Whitelist management |
|
|
Hi, I am a heavy regular user of mailwasher, I love it
The problem I am having is that I have a business that receives random email that is legitimate from some domains that I would otherwise blacklist because they receive a lot of spam - so I have to skim all emails regardless.
-I don't want to miss legitamate customers email
-blacklist searching - management is too slow and clumsy to check for legitimate customers though the lists
I would highly reccomend a seperate program/module accessed from mailwasher for doing all of the whitelist blacklist filter management stuff, probably to include;
-searching, filtering, sorting
-turn a set of email addresses into a domain filter
-statistical analisys
-viewing the most recent email body stored in the database connected to the selected email
-being able to work on a set of emails in one step by selecting a group of them or filtering and working on all that are visible
-search function could also include the body text stored in the database
I realise this can be a real paradigm shift to a much more proactive management - but for me, it is either something like this or a email verification system which I would rather not make the customers go through.
If anyone has suggestions how I might better utilize Mailwasher in its current version , it would be much appreciated
-Roger
|
|
| Back to top |
|
 |
stan_qaz
Premium Member
 Joined: Mar 31, 2003 Posts: 10579
|
Posted: Fri May 04, 2007 7:59 pm Post subject: |
|
|
Forget the MW marketing spiel.
Remember one really basic fact:
BLACKLISTING does not blacklist the source of the spam!
All the blacklist does is add the e-mail address that the spammer chose to forge into the message header to a list of addresses that MW will show as blacklisted.
Spammers know that people spend endless hours adding their forged addresses to blacklists and waiting while anti-spam programs churn through thousands and thousands of forged addresses looking for a match.
Spammers are not stupid, they use fresh addressed for almost every spam run so that the blacklisters can happily blacklist the forged address without bothering the spammer who will never use it again. Sometimes just for fun they will use a real address... just not one of theirs, they pick some innocent third party.
Spammers have a sense of humor, if they can get you to blacklist a bunch of innocent folks just by stealing their addresses they get hours of chuckles for free.
Hopefully you are beginning to see a pattern here -- blacklisting doesn't work as advertised. It is not alone in being pumped by anti-spam marketers selling to the gullible and uneducated, look at the wiki article on bouncing for a real marketing scam.
Blacklisting does have one small redeeming quality BUT ONLY if you use it properly. If you get several spam messages from the same address on each spam run, either to one account or to multiple accounts - blacklisting will tie them together and let you mark them all with one click. For this to be effective you need to keep the blacklist retention very short, 3 days is more than long enough, anything more just helps the spammers disrupt normal e-mail traffic. I don't bother, the learning tool is much more effective and much harder for the spammers to fool.
There is a very good getting started with MW article in the wiki that is pretty much what I use even now, it hasn't missed a spam or tagged a good message in some time.
To effectively use MW you need: a good friends list, to setup and use the learning tool option and a couple simple filters for protecting recycled messages and ones from yourself. That's it nothing more is really needed.
You can go beyond the basics if you find something that MW is missing time after time even if you have trained it but only a small fraction of users need to go that far.
Bottom Line: Yes the MW marketing weasels lied to you about the effectiveness of some of the "features" of MW but once you get over being ticked off at that the remaining features work very well and MW is still the best anti-spam product I've found. _________________ Questions? Try the wiki
http://wiki.castlecops.com/MailWasher_Pro
|
|
| Back to top |
|
 |
AlphaCentauri
SIRT Handler Premium Member
 Joined: Nov 20, 2003 Posts: 2626
|
Posted: Sat May 05, 2007 3:22 am Post subject: |
|
|
If you REALLY want to blacklist, you have to create a mailwasher filter that blocks IP numbers in the header. There are a few blocks of IP numbers that are responsible for massive amounts of spam, and you can create filters that will sort for those. If you don't get a lot of mail from Asia or Russia, it may be a useful filter for you, though it will make it take a lot longer to filter your mail.
That being said, spammers no longer send spam from their own email accounts, even with forged headers. They put malware on other people's computers ("botnets") that allow them to commandeer them to send the spam a few messages at a time from each computer to avoid notice. Still, since that system relies on infecting users who may have outdated or pirated versions of Windows or antivirus programs, there will still be more of them in IP ranges from countries with weak intellectual property enforcement.
|
|
| Back to top |
|
 |
darkroomdevil
Trooper

 Joined: May 04, 2007 Posts: 12 Location: USA
|
Posted: Sat May 05, 2007 5:35 am Post subject: |
|
|
WOW
Thanks for the straight talk
If I hop on to this conceptual band wagon, from the MW pint of view, are you implying that we would be rogue? In other words, is this embrassed or endorsed by MailWasher at all? ... I am not saying that that would be good or bad, I am sure there is more than one way to view these truths even for those that are in complete agreement as to the facts.
I will go look at the wiki - and thanks! - but my problem is still that I don't want to comb though all of the emails that are bad - since it is not guarenteed at 100% (what is ... ), it seems I will still need to do this no mater what system is used. I will go read the wiki, if I get any ideas I will post back ...
Thanks!
-Roger
|
|
| Back to top |
|
 |
AlphaCentauri
SIRT Handler Premium Member
 Joined: Nov 20, 2003 Posts: 2626
|
Posted: Sat May 05, 2007 3:24 pm Post subject: |
|
|
If you are willing to lose some emails, your ISP probably can provide pretty good spam filtering for you. MWP is for people who are not willing to tolerate "false positives" and want a way to retain complete control of what gets deleted yet protect themselves from some of the malware that might be released by opening email on a full function email program.
But I'm not sure why you think it is "rogue." The spammers are the ones doing things illegally. We're trying to keep on top of their latest permutations to maintain our ability to see our email without wading through all the spam.
|
|
| Back to top |
|
 |
stan_qaz
Premium Member
 Joined: Mar 31, 2003 Posts: 10579
|
Posted: Sat May 05, 2007 7:40 pm Post subject: |
|
|
I really do very little looking at my mail, just a quick scan to see what is in the inbox and mark anything that is a new friend or was missed by learning (few are) and hit process.
The wiki will give you plenty on bouncing, it is a very bad thing.
Blacklisting isn't bad other than being a nearly complete waste of your time.
The firetrust position is pretty simple, the boss wants bouncing to stay, the workers get input but he decides. _________________ Questions? Try the wiki
http://wiki.castlecops.com/MailWasher_Pro
|
|
| Back to top |
|
 |
darkroomdevil
Trooper

 Joined: May 04, 2007 Posts: 12 Location: USA
|
Posted: Sun May 06, 2007 4:15 am Post subject: |
|
|
Alpha and Stan - Thanks for the replies!
Alpha - OK, Rogue was a little toungue and cheek - I really did mean what I said after: "In other words, is this embrassed or endorsed by MailWasher at all?" And by that I meant the attitudes about bouncing, blacklist management and the implications that those parts of the program are included for marketing/sales reasons only, but my opinion is way toned down - giving respect to the idea that they do need to sell the product to stay in business and that they may really arrive at a different slant on the ideas with the same set of facts.
I am one of those that won't tolerate 'false positives' being lost bu my isp ...
stan - Thanks for the heads up on the Firetrust position, I really do understand.
-Roger
|
|
| Back to top |
|
 |
AlphaCentauri
SIRT Handler Premium Member
 Joined: Nov 20, 2003 Posts: 2626
|
Posted: Sun May 06, 2007 4:41 am Post subject: |
|
|
I don't get too upset by what appears to be false advertising. There is a steady stream of new users that come here with questions about bouncing. They found Mailwasher because they all got the same bright idea we did, which is that if the spammer thought our email address no longer was in use, they would remove us from their email lists just the way we remove people from our email lists when our mail to them bounces.
And initially, that was the way it worked, back when spam had real return email addresses and spammers paid for their own internet access to send their spam. It doesn't anymore, but we're all still using Mailwasher because it's a great product. The only product that actually got spammers to remove names from their lists was BlueFrog (which Mailwasher interacted with); search the forums to find out how spammers reacted to that bit of success.
|
|
| Back to top |
|
 |
Ikeb
Special Response Team Forums Admin
 Joined: Apr 20, 2003 Posts: 16505
|
|
| Back to top |
|
 |
stan_qaz
Premium Member
 Joined: Mar 31, 2003 Posts: 10579
|
Posted: Mon May 07, 2007 4:27 am Post subject: |
|
|
Perhaps the boss says different things to different people.
Removing the bounce feature from the promotional stuff is a few minute operation.
Removing it from the program would be a bit more difficult but it could be done.
When I see a change I'll believe it, until then...  _________________ Questions? Try the wiki
http://wiki.castlecops.com/MailWasher_Pro
|
|
| Back to top |
|
 |
darkroomdevil
Trooper

 Joined: May 04, 2007 Posts: 12 Location: USA
|
|
| Back to top |
|
 |
stan_qaz
Premium Member
 Joined: Mar 31, 2003 Posts: 10579
|
Posted: Tue May 08, 2007 4:16 am Post subject: |
|
|
Getting reported to your ISP for mail forgery/abuse isn't a minor problem for many folks. The better ISPs are now detecting forged outgoing headers and attempting to block them.
Having a bunch of the Anti-Spam folks refusing to recommend your program because the bounce is a bad thing really hurts sales. I've gotten so tired of getting hammered about it that I always post the bounce problems in any recommendation for MW which really is a turn off for prospective buyers.
I sort on one of two fields. If I'm not planning on processing mail for a while, the Arrived Time of the message - that puts the new mail at the top of the list where it is easy to see. If I'm actually working with the mail I sort on the Status so the like stuff is grouped and I can "block select" and tick stuff with less effort and clicking. _________________ Questions? Try the wiki
http://wiki.castlecops.com/MailWasher_Pro
|
|
| Back to top |
|
 |
darkroomdevil
Trooper

 Joined: May 04, 2007 Posts: 12 Location: USA
|
Posted: Tue May 08, 2007 5:50 am Post subject: |
|
|
| stan_qaz wrote: | | Getting reported to your ISP for mail forgery/abuse isn't a minor problem for many folks. |
This implies an understanding of a situation that I am not familiar with ... do you mean that if a spammer forged my name, my ISP might beleive that it really came from me and punish me instead of realizing that it could be forged? Are the ISPs not savvy in their own industry?
| stan_qaz wrote: | | The better ISPs are now detecting forged outgoing headers and attempting to block them. |
cool
| stan_qaz wrote: | | Having a bunch of the Anti-Spam folks refusing to recommend your program because the bounce is a bad thing really hurts sales. I've gotten so tired of getting hammered about it that I always post the bounce problems in any recommendation for MW which really is a turn off for prospective buyers. |
So by bringing it up you take the wind out of their sails ... proactive instead of defensive? - OK
There is always going to br a few 'perfect people' that have a problem with something no matter what you do ... or just regular folks with strong opinions. Either way you can also take some of the wind out of the sails by just agreeing - the more discussion there is the more importance you are giving - and in reality it is just one facet of a great program. In most everything there is something that can be improved - and one persons improvement is going to anothers complaint ...
| stan_qaz wrote: | | I sort on one of two fields. If I'm not planning on processing mail for a while, the Arrived Time of the message - that puts the new mail at the top of the list where it is easy to see. If I'm actually working with the mail I sort on the Status so the like stuff is grouped and I can "block select" and tick stuff with less effort and clicking. |
Wow - THANK YOU - I didn't realise I could block select, tick one and all selected would update. So the new technique with this info;
- sort by Status
- highlight first row
- hold down shift key while hitting down arrow until I get to the end of the bad boys to select them all and review at the same time
- one click on a delete checkbox within any that are selected ... yeah!
I feel silly being excited about this, but add each technique together and it starts to make a real difference for me
-Roger
|
|
| Back to top |
|
 |
stan_qaz
Premium Member
 Joined: Mar 31, 2003 Posts: 10579
|
Posted: Tue May 08, 2007 6:22 am Post subject: |
|
|
| Quote: | | This implies an understanding of a situation that I am not familiar with ... do you mean that if a spammer forged my name, my ISP might beleive that it really came from me and punish me instead of realizing that it could be forged? Are the ISPs not savvy in their own industry? |
Has nothing to do with a spammer, only the action you take: faking a bounce to an address that you have no way to prove is associated with sending the spam.
A bounce generated by MW is a mail forgery, you are faking the header and sending a fake bounce to the address the spammer wants it to go to. Not to the spammer
My ISP and many others call that abuse and will close your account if you keep it up.
You stand a decent chance of being reported to spamcop.net and getting your ISPs mail server blacklisted and cause all their customers mail delivery problems if you bounce mail to a stolen e-mail address.
You could even bounce to me and end up here:
http://www.stanmiller.info/pages/clueless.html
It has nothing to do with someone else using your text e-mail address, that is a completely different issue.
The ISP can easily see that they didn't send the fake bounce and track it back to your IP address. Given the grief it can cause them they are often not amused by this type of thing. _________________ Questions? Try the wiki
http://wiki.castlecops.com/MailWasher_Pro
|
|
| Back to top |
|
 |
Ikeb
Special Response Team Forums Admin
 Joined: Apr 20, 2003 Posts: 16505
|
Posted: Tue May 08, 2007 6:24 am Post subject: |
|
|
| darkroomdevil wrote: | Stan and Alpha - The MW bouncing issue is a hard one, if the feature brings in new customers ... I can see MW not advertising it's uselessness on their site if they want to sell their program - but they do link to this forum where the info is available. Some will buy the program because of the feature list and never utilize bouncing after a few bouncing bounce backs or whatever ... others will love it for it and I do't think that will cause any real harm ... most of the casual users, I think, will ignore it and love the program for what it does best ...  |
If someone buys MWP for the supposed benefits of the bounce feature (and many have based on comments made at these forums), at best it's misleading, thus false advertising.
Also, define "real harm". Imagine your email address being set as the "Return-Path" address in a spam mailout. I don't think you'll consider the fallout as a mere minor inconvenience.
For those of us who help others deal with real MWP problems, this false "official" info is a real PITA because of the number of times new users come here with bounce problems. One of the reasons I kept bugging Paul for a wiki was to mitigate this situation. FireTrust action to correct the problem at it's source is long overdue . _________________
|
|
| Back to top |
|
 |
|
|