To: Alvaro Herrera <alvherre@commandprompt.com>
cc: Magnus Hagander <magnus@hagander.net>,
	Greg Sabino Mullane <greg@turnstep.com>, w^3 <pgsql-www@postgresql.org>
Subject: Re: Stopping link spam on the lists 
In-reply-to: <1333845038-sup-6474@alvh.no-ip.org> 
References: <16170.1333746317@sss.pgh.pa.us>
	<c38808b085b1897dc873e6c36f2e140d@biglumber.com>
	<CABUevEyLXSAOEBLa4SFUm9pB_470wVgG4sUEKyfd9SVhU5yxEQ@mail.gmail.com>
	<1333845038-sup-6474@alvh.no-ip.org>
Comments: In-reply-to Alvaro Herrera <alvherre@commandprompt.com>
	message dated "Sat, 07 Apr 2012 21:32:25 -0300"
Date: Sat, 07 Apr 2012 23:14:57 -0400
Message-ID: <14092.1333854897@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>

Alvaro Herrera <alvherre@commandprompt.com> writes:
> The remaining question, in my mind, is: is there a way to reliably
> detect that link spam is just link spam and reject it altogether in
> Spamassassin?  If that's the case, then we could do it at that level and
> save the work downstream.  This is something that Stefan would have to
> answer.

FWIW, all the examples I have seen recently bore all of these traits:

* empty subject line (other than the [LISTNAME] prefix attached by our
  own forwarding code)
* no content to speak of except the payload link
* To: addressed to multiple unrelated addresses

I'm not sure how much the last point helps, unfortunately, because a
heck of a lot of what passes through our lists has multiple To:, and
I doubt it's practical for the spam filter to test how many of the
target addresses are people subscribed to the lists.  The empty subject
would be easy to test for, but surely the spammers will figure out
not to do that soon.

Anyway, what I've been seeing lately has all had X-pg-spam-score 3.5 or
more, which is what made me suggest that moderating on that basis would
improve matters.

			regards, tom lane