Quoting David Cary Hart <Fedora@xxxxxxxxxxx> Date: Sun, 06 Feb 2005 18:23:16 > After eight months, the same nitwits were still spamming, the instant > that the new MX was propagated, to the tune of 3,000 emails per day to > former employees. A timeout on a dead link is as expensive as it gets. Spammers often adjust timeouts to be much lower than what is usually used for normail mail traffic (or TCP/IP protocol itself). At home, I'm running SpamAssassin on an ancient slow machine. Sometimes, spammers don't wait for SpamAssassin to finish its job, they disconnect after relatively short timeout (long enough for normal machine to finish SpamAssassin checks, too short for this very old machine). The reason is probably minimazing impact of tar-pits. If you write filter that is as smiple and stupid as sleeping for 60 seconds after "dot on the line by itself", you'll block some spam (not much, but some). Of course, I'm not suggesting actually implementing this. It would be a very bad thing if something like that become widespread (and as I already said, not very efficient, you are looking in like blocking at most 1-2% of spam). -- Aleksandar Milivojevic <amilivojevic@xxxxxx> Pollard Banknote Limited Systems Administrator 1499 Buffalo Place Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7
