|
[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
NotDashEscaped: You need GnuPG to verify this message
>> I set a limit on the message size and reject HTML emails. Catches just
>> about everything.
> After browsing through the PLUG mail archives sorted by size, I don't
> believe decreasing the maximum acceptable message size from it's current
> limit of 100k would do much good. Many worms appear to have a very small
> payload, some as small as 10k, and there have been a number of legitimate
> posts larger than 10k.
Most worms are right around 30k, and rare indeed is the legitimate post of
that size. Besides, you don't have to reject them, you just have to have
Mailman hold them for admin consideration. That way, legitimate emails can
still go thruogh, they just need manual approval. I do this for a few lists I
run, and while it can be a pain for the admin a times, it makes the mailing
list members a lot happier.
Here's my recent dump of plug emails sorted by size:
size | subject | rdate
-------+--------------------------------------------------------+-----------
43311 | [PLUG] Mail delivery failed: returning [snipped] | 2004-04-21
31584 | [PLUG] beautiful | 2004-03-01
30408 | [PLUG] Hi | 2004-04-29
29487 | [PLUG] Weah, hello! :-) | 2004-03-16
29253 | [PLUG] Weeeeee! ;))) | 2004-04-30
29005 | [PLUG] Hi | 2004-04-29
28857 | [PLUG] Weeeeee! ;))) | 2004-04-29
28576 | [PLUG] :-) | 2004-04-30
25877 | [PLUG] Approved | 2004-04-11
25476 | [PLUG] Hardware devices price-list | 2004-02-29
25233 | [PLUG] Greet the day | 2004-03-03
24996 | [PLUG] Re: Your letter | 2004-05-03
24875 | [PLUG] [plug-announce] Ello! | 2004-03-02
19499 | RE: [PLUG] [OT] Postage on EMail? | 2004-03-11
15873 | [PLUG] ID cmthaxvtqq... thanks | 2004-02-17
14070 | RE: [PLUG] Usage ideas for home network... [snipped] | 2004-02-25
13875 | Re: [PLUG] Linux on the desktop: closer than you think | 2004-02-27
12610 | [PLUG] boot messages error {was: hello} | 2004-04-18
12257 | Re: [PLUG] Interview Questions: System Admin | 2004-02-14
11716 | [PLUG] (no subject) | 2004-03-26
You'll notice that everything above 20k is a worm. The message at 12610 bytes
is actually the first non-worm, non-HTML email, so the barrier could probably
be lowered to to 15k, which would catch that worm at 15873.
--
Greg Sabino Mullane greg@turnstep.com
PGP Key: 0x14964AC8 200405040932
-----BEGIN PGP SIGNATURE-----
iD8DBQFAmCjnvJuQZxSWSsgRAoWlAKDvibl1yVrG5iSHonkmUOVq3e3/JgCgyAoo
zDQ9XQoVLncaBPeAR0ozaOo=
=AeWv
-----END PGP SIGNATURE-----
___________________________________________________________________________
Philadelphia Linux Users Group -- http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug
|
|