[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
NotDashEscaped: You need GnuPG to verify this message
>> I set a limit on the message size and reject HTML emails. Catches just
>> about everything.
> After browsing through the PLUG mail archives sorted by size, I don't
> believe decreasing the maximum acceptable message size from it's current
> limit of 100k would do much good. Many worms appear to have a very small
> payload, some as small as 10k, and there have been a number of legitimate
> posts larger than 10k.
Most worms are right around 30k, and rare indeed is the legitimate post of
that size. Besides, you don't have to reject them, you just have to have
Mailman hold them for admin consideration. That way, legitimate emails can
still go thruogh, they just need manual approval. I do this for a few lists I
run, and while it can be a pain for the admin a times, it makes the mailing
list members a lot happier.
Here's my recent dump of plug emails sorted by size:
size | subject | rdate
-------+--------------------------------------------------------+-----------
43311 | [PLUG] Mail delivery failed: returning [snipped] | 2004年04月21日
31584 | [PLUG] beautiful | 2004年03月01日
30408 | [PLUG] Hi | 2004年04月29日
29487 | [PLUG] Weah, hello! :-) | 2004年03月16日
29253 | [PLUG] Weeeeee! ;))) | 2004年04月30日
29005 | [PLUG] Hi | 2004年04月29日
28857 | [PLUG] Weeeeee! ;))) | 2004年04月29日
28576 | [PLUG] :-) | 2004年04月30日
25877 | [PLUG] Approved | 2004年04月11日
25476 | [PLUG] Hardware devices price-list | 2004年02月29日
25233 | [PLUG] Greet the day | 2004年03月03日
24996 | [PLUG] Re: Your letter | 2004年05月03日
24875 | [PLUG] [plug-announce] Ello! | 2004年03月02日
19499 | RE: [PLUG] [OT] Postage on EMail? | 2004年03月11日
15873 | [PLUG] ID cmthaxvtqq... thanks | 2004年02月17日
14070 | RE: [PLUG] Usage ideas for home network... [snipped] | 2004年02月25日
13875 | Re: [PLUG] Linux on the desktop: closer than you think | 2004年02月27日
12610 | [PLUG] boot messages error {was: hello} | 2004年04月18日
12257 | Re: [PLUG] Interview Questions: System Admin | 2004年02月14日
11716 | [PLUG] (no subject) | 2004年03月26日
You'll notice that everything above 20k is a worm. The message at 12610 bytes
is actually the first non-worm, non-HTML email, so the barrier could probably
be lowered to to 15k, which would catch that worm at 15873.
--
Greg Sabino Mullane greg@turnstep.com
PGP Key: 0x14964AC8 200405040932
-----BEGIN PGP SIGNATURE-----
iD8DBQFAmCjnvJuQZxSWSsgRAoWlAKDvibl1yVrG5iSHonkmUOVq3e3/JgCgyAoo
zDQ9XQoVLncaBPeAR0ozaOo=
=AeWv
-----END PGP SIGNATURE-----
___________________________________________________________________________
Philadelphia Linux Users Group -- http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug