[OT] New Play: SPAMELOT

[Tim Peters]

[Erik Max Francis]
> ...
> The problem with this latest round of worm spam isn't that it's
> bypassing filters (I just have some reasonably sane filtering
> rules in my system, certainly nothing customized to this latest worm
> attack -- I don't even really know which rules are stopping it), it's
> putting significant loads on mail servers.  Unfortunately, running an
> intensive, per-user customized spam filtering solution like Spambayes
> _increases_ that load.

SpamBayes was designed to run client-side, although a few people have made
it part of server-side systems.  Most users' PCs sit idle most of the time.
Greg Ward made the most impressive server-side use of SpamBayes that I know
of to date, to filter the Python and Zope mailing lists run via python.org.
There's no per-user customization in those, and it isn't needed because a
tech mailing list has a natural shared focus.  Greg did set up several
distinct classifiers for different groups of mailing lists.

SpamBayes isn't notably intensive, either.  One of the reasons Greg moved
the python.org mailing lists to SpamBayes filtering is that it runs much
faster than SpamAssassin (which python.org used to use).

The biggest drains caused by worm spew are on bandwidth and disk space.
Filters don't add to the former unless they do lookups over the net
(SpamBayes does not), and a very effective SpamBayes classifier can fit
entirely in a small corner of a typical server's RAM.

not-bothering-to-refute-that-the-sky-is-pink<wink>-ly y'rs  - tim