LogSat Software

Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic

   After having put this product up in production for an hour or so, and then taking it down.   I have a few observations and comments.  Great potential in this product, but there needs to be a few issues addressed (some I am unclear on what your product does)

1. We need the ability to seperate connectoin refusal (NO) DATA, and filtering.   What I mean is that we have to be  able to not initiate the DATA connection at all.    When I blacklist an IP I do not want the DATA conversation to occur at all, and I do not want to notify the sender, and I do not want any other filtering processes to occur.  I do not want the wasted bandwidth.
2. When I blacklist a domains/email on To/From address, I would suggest the default to be to quaranteen, but with an option to Refuse Data connection immediately at the TO/FROM dialogs.  
3. I think blacklisting needs three levels..  - Refuse (No Data, No Notif.) - Filter (Quar.) with Notification - Filter (BlackHole) with no notifications..   Many spammers use responses from filtering to qualify thierr spam email lists..   and if you reply to them, you just giving them a qualified lead.    We need control of these filtering levels.   
4. The quarantines items should give you Black/White listing options..  so we can filter based up them.  I would go so far as even being able to parse the subject into descreet strings to build a keyword filter line from there..  Or remove the filters.. etc..
5. Keyword Quoted Strings and whitespace conventions.. 
6. To be able to stop the filtering hierarchy at certain levels.   At the ip refusal.  stop all filtering..  at the from stop.. at the to stop..  
7. Seperating Subject and Message body filtering (do not know what you do here..)
8. Attachment filtering..
Over all your product could be very nice, and I hope you continue the forward progress on it..   I will not be able to use until I can stop data connections (refuse), base upon ip/domain and to/from filtering
as the volume of spam here is way too high to allow it..   I will continue to test your product to see if I can fit it into our email world here..  Great work your doing.. Keep it up..

Thanks, Bob

Author	Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic
Bob Members Profile Send Private Message Find Members Posts Add to Buddy List Guest Group	Post Options Post Reply Quote Bob Thanks(0) Quote Reply Topic: Product Suggestions.. Posted: 23 April 2003 at 11:07am
	After having put this product up in production for an hour or so, and then taking it down. I have a few observations and comments. Great potential in this product, but there needs to be a few issues addressed (some I am unclear on what your product does) 1. We need the ability to seperate connectoin refusal (NO) DATA, and filtering. What I mean is that we have to be able to not initiate the DATA connection at all. When I blacklist an IP I do not want the DATA conversation to occur at all, and I do not want to notify the sender, and I do not want any other filtering processes to occur. I do not want the wasted bandwidth. 2. When I blacklist a domains/email on To/From address, I would suggest the default to be to quaranteen, but with an option to Refuse Data connection immediately at the TO/FROM dialogs. 3. I think blacklisting needs three levels.. - Refuse (No Data, No Notif.) - Filter (Quar.) with Notification - Filter (BlackHole) with no notifications.. Many spammers use responses from filtering to qualify thierr spam email lists.. and if you reply to them, you just giving them a qualified lead. We need control of these filtering levels. 4. The quarantines items should give you Black/White listing options.. so we can filter based up them. I would go so far as even being able to parse the subject into descreet strings to build a keyword filter line from there.. Or remove the filters.. etc.. 5. Keyword Quoted Strings and whitespace conventions.. 6. To be able to stop the filtering hierarchy at certain levels. At the ip refusal. stop all filtering.. at the from stop.. at the to stop.. 7. Seperating Subject and Message body filtering (do not know what you do here..) 8. Attachment filtering.. Over all your product could be very nice, and I hope you continue the forward progress on it.. I will not be able to use until I can stop data connections (refuse), base upon ip/domain and to/from filtering as the volume of spam here is way too high to allow it.. I will continue to test your product to see if I can fit it into our email world here.. Great work your doing.. Keep it up.. Thanks, Bob

LogSat Members Profile Send Private Message Find Members Posts Add to Buddy List Admin Group Joined: 25 January 2005 Location: United States Status: Offline Points: 4104	Post Options Post Reply Quote LogSat Report Post Thanks(0) Quote Reply Posted: 23 April 2003 at 7:04pm
	We'll consolidate anwers for 1, 2 and 3 into one. If an administrator wants to quarantine email so that he/she can force delivery of legitimate email that was blocked, the incoming message must be received in its entirity. Thus, if quarantine is enabled, the rejection message can only be sent to the sender after the sender has sent the DATA command and the msg itself. If quarantine is disabled, then the connection will be dropped before the they get to issue the DATA command. Since it could have been confusing to users if we started to have exceptions to this rule, as in "if I blacklist this or I blacklist that I don't want to quarantine", we decided at first to make the behaviour uniform with all settings. In build 1.1.0.91 (which is currently available only to registered users) we have added options to allow the admins to decide what to do with almost every single reject reason (ex. MAPS, local lists, no DNS, etc). They can now choose if failing that particular test results in an immediate reject, or a quarantine, thus providing most of the functionality you suggest. For number 4, the quarantine was something we put together in a hurry since there was the need for it. We'll be revising it greatly very soon. We are instead working on database'ing is the quarantine. We're trying to do it as openly and flexibly as we can, so you can use MSSQL, Oracle, Access, etc, and will try to provide some kind of interface to it so end-users can check their own quarantine. It will be at least a month or two before we have this done though. So we'd rather not make minor mods to it, and instead use that time to focus on the major changes. Number 5, keywords. Our convention asks for: this is a string,this is another string instead of: "this is a string" and "this is another string" We do not currently have any options for whitespace. Number 6. That could make usage very complicated... If there will be positive feedback on this one we'll definetly add it in though. Number 7. Currently both message body and all SMTP headers are scanned for the keywords. Number 8. This has been requested before as well, and we'll be addign it in shortly. Roberto Franceschetti LogSat Software

metrotel Members Profile Send Private Message Find Members Posts Add to Buddy List Guest Group	Post Options Post Reply Quote metrotel Thanks(0) Quote Reply Posted: 25 April 2003 at 9:39am
	End user quarantine access: You could setup a second mail server "myspam.mydomain.net" It would be a clone of the mail.mydomain.net as far as users and passwords are concerned. or you could build it all in to the filter and then you have a mail server with filtering instead of a great filter...

LogSat Software

Site Navigation[Skip]

Spam Filter ISP Support Forum

Product Suggestions..