my solution to image spam (previously mentioend consistant failures)

Looking into the contents of the image spams that spamprobe was
consistently missing, testing out crm114, and discussing the issue with the
authors of both, I decided that rejecting all emails with inlined attached
images was inevitable.  

My discomfort with this was the possibility of false positives, and
choosing between sending a lot of bounce messages to forged From: addresses
or sending no notification to legit senders.  

Then a friend pointed out to me that spam can be scored and rejected before
the end of the initial SMTP session, resulting in the sending mail server
being responsible for sending the bounce.  So I'm bouncing all email with
an inlined attached image during the initial SMTP session, and it's working
beautifully.

Using Postfix as my mail server, I'm bouncing with body_checks:
http://www.postfix.org/header_checks.5.html
The specific regex I chose is from:
http://archives.neohapsis.com/archives/postfix/2006-05/0430.html

Now people can still send me image attachments, but they can't include it
in the body of the email via an <img src>.  I think I've pretty thoroughly
considered the options (including OCR, which some are integrating into
SpamAssassin), and I believe they are all temporary measures.  For that
reason I believe disallowing inline image attachments will inevitably
become common policy.

-- 
"If you are not paranoid... you may not be paying attention."
 - [email protected], on an IDPA mailing list
http://www.ChaosReigns.com

-------------------------------------------------------------------------
SF.net email is sponsored by: A Better Job is Waiting for You - Find it Now.
Check out Slashdot's new job board. Browse through tons of technical jobs
posted by companies looking to hire people just like you.
http://jobs.slashdot.org/