The Substantially Similar Weblog

Spam gets more clever all the time. Yesterday, this· appeared on the debian-mentors list·:

 Date: Wed, 7 Apr 2004 22:36:41 -0700 (PDT) From: rasheed badmus  Subject: free game boy To: debian-mentors@lists.debian.org Hello: I'd like to request for someone to sponsor the following unofficial packages I have: snes9express (1.39-beta) - a GUI frontend for SNES9x (as far as I know this is still an orphaned package); and visualboy advance (a gameboy/gameboy color/gameboy advance emulator for Linux). The said packages can be obtained in this apt source location: anything that u want to send,send it by this below. P.O box 1103 agodi Ibadan, Oyo state, Nigeria. 

Although list members quickly figured out that this was actually spam·, someone made a good point: if spammers start using text from a typical posting to a list in the body of their message, it’s going to be very hard to use content-based filters reliably. I can’t see how, for example, a Bayesian filter would be able to drop the above message in the right bin.

Also, see this fairly technical but fascinating description of how an Internet cafe technician in Dublin caught a spammer red-handed·. The best part is where the spammer tries to eat his USB memory stick so the police won’t get it. (Sorry, this is one instance where my civil liberties instincts are overcome by my harsh justice instincts).

(this is another case where this post would ideally be filed under two categories—”Debian” and perhaps “spam”—which is not yet a category.)

I’ve written before about one of the various forms of Internet pestilence: messages bounced back from virus filters that claim you emailed them a virus, when in fact the mail header was forged and the virus originated elsewhere. It’s particularly frustrating to those of us who use GNU/Linux and thus are practically immune from viruses, at least those that propagate through email.

Here’s my latest attempt at an omnibus virus bounce procmail filter. Put this in ~/.procmailrc and most if not all of these messages should go away. Note that you need to increase from the default LINEBUF length to pack this all into one expreession:

Suggestions for additional filter strings are welcome. This is an obvious case where there should be some standard for this kind of message, but of course each proprietary virus scanner company wants to have its own distinct announcement so as to advertise its product in the bounce message. The best thing would be something in the mail header other than the subject line.

I’ve also found the following recipe useful for filtering out a very common viral email that appears to be going around:

You could probably substitute virus with /dev/null without any ill effects in both of these recipes.

Finally, a neat trick if you use SpamAssassin. This is covered in the documentation, but I only recently discovered it. Here’s a way to filter very certain spam into one folder, and pretty certain spam into another:

Set the number of stars in the first recipe to be the SpamAssassin score you’d like to count as “very certain.”

The U.S. Trademark Trial and Appeal Board announced on Tuesday that the term “realtor” is not generic, but instead a protectable mark. In other words, “realtor” isn’t just anyway who sells real estate, but attaches only to a member of the National Association of Realtors.