confirmation list size seems way too small!

The confirmation list is a technique to prevent ASK from sending too
frequent challenges to the same From: address. It is important because
(among others) it protects ASK from being easily morphed into a
"spamming with challenges" tool.

http://a-s-k.sourceforge.net/paper/node3.html#SECTION00034000000000000000

Here follows my understanding of the relevant code. Please correct me
as soon as I am wrong (and then don't read the rest).

The code is located in askmessage.py:__check_confirm_list() It uses
undocumented user parameters found in askconfig.py. These parameters
bound the size of the list (the number of tested From:) between a
minimum and maximum value. The list oscillates between those two
values, older entries being purged first. The maximum number of
confirmations sent to an individual adress is configured in the same
way (an other parameter) which is 5 by default. 5 seems to me a bit
too high but that's not the issue here. You have to know that if ASK
sends 3 confirmations to some From:, it uses 3 slots in the global
confirmation list.

According to the latest cvs version of askconfig.py (1.55 from
2004/10/18), the defaults for the size of the list are only... 20
and 40! That is: the size of the list oscillates between 20 and 40.
(remember that multiple requests to the same From: use multiple
slots).

Since I receive about 100 spams per day, I suspect that my list moves
so fast (completely renewed about 3 times a day) that it totally
defeats this protection. I discovered it because the victim of a
repeatedly faked From: finally complained to me.


 In brief, I find the default size of this confirmation list way too
 small.


As a temporary fix, I just added to .askrc:

rc_min_confirmation_list = 500
rc_max_confirmation_list = 600


As a permanent fix, I suggest corresponding changes in askconfig.py,
and also changes in templates/ask.rc, since optimal values are heavily
dependent on the average volume of spam received per day. I can post
the (trivial) patches to sourceforge if some consensus is achieved on
default values.

Thanks in advance for your comments.


-- 
"Je n'ai fait cette lettre-ci plus longue que parce que je n'ai pas eu
le loisir de la faire plus courte." -- Blaise Pascal



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/