Discussion from Clamav list

There is a discussion going on over at the ClamAV users list about 
ASK (see below), and I was just curious...this discussion prompted me 
to wonder. What if the majority of forged email address are real. 
Will innocent users be getting these confirmation requests?

>  > >I just tried to reply to your mail but got this response.
>>
>>  yes, i'm using ASK for spam protection. The meaning of the automatic
>>  response is: reply this email and you'll be added to rbellora's
>>  whitelist. I received your email anyway.
>
>So, how does that help protect you from spam?   It sounds like your system
>receives a spam email from some unknown and probably forged address, delivers
>the spam to you anyway, and then sends its own message back to the forged
>adderss, to some poor innocent who didn't send the spam in the first
>place...?
>
>I'm not sure I see why this is a good idea (or have I misunderstood how it
>works?)


>>I'm not sure I see why this is a good idea (or have I misunderstood 
>>how it works?)
>>
>it works like this: any email received not in my whitelist is 
>blocked until the sender replies to the automatic response, or i 
>unblock it myself and then is delivered. I made a script (it runs 
>once an hour on business hours) to notify me when there is some new 
>email that does not seem spam (according to SpamAssassin) waiting, 
>sending me a link to an html report form of what's pending. Using 
>the form, i delete what's spam (with option to including the sender 
>in an ignorelist or blacklist), and, if there's some nonspam i 
>deliver and optionally whitelist the sender. I like it


>  > it works like this: any email received not in my whitelist is blocked
>>  until the sender replies to the automatic response
>
>Doesn't that result in your mail server either attempting delivery to
>addresses which fail, or successfully delivering to innocent (forged)
>addresses, in response to most of the spam you get?
>
>I've always been doubtful about any auto-response mechanisms, considering how
>much spam (and viruses) comes from forged sender addresses these days.


>>Doesn't that result in your mail server either attempting delivery 
>>to addresses which fail, or successfully delivering to innocent 
>>(forged) addresses, in response to most of the spam you get?
>>
>yes it does. Regarding forged address, they receive hundreds of 
>bounces anyway. I don't see failed delivery as a problem (the 
>bounces are discarded by ASK)

-- 
--

Craig Daters ([email protected])
Systems Administrator
West Press Printing
1663 West Grant Road
Tucson, Arizona 85745-1433

Tel: 520-624-4939
Fax: 520-624-2715

www.westpress.com

--

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.



-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click