Justification for mailscanner.

[mikea]

On Mon, Mar 01, 2004 at 04:54:01PM -0500, Stephen Swaney wrote:
>  
> ________________________________________
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf
> Of Limmer, Jim
> Sent: Monday, March 01, 2004 4:35 PM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Justification for mailscanner.
> 
> 
>  My company has budgeted a good amount of money for a spam/virus filtering
> email gateway, similar to what I can accomplish with mailscanner. We've
> tested a few commercial products, none to our satisfaction. While we are
> meeting with their sales staff I typically jot down each application they
> are using. It's amazing the amount of money some of these vendors are
> charging for what is 99% open source software. Typically these boxes are
> running redhat, postfix, sa, razor
 the list goes on. The only proprietary
> software I see on these boxes are their web gui front ends, which are
> typically attractive, but IMHO - useless.
> Anyway, the question was put to me today - how can you justify wanting to
> spend valuable man hours building and configuring our own system based on
> open source, when we've already budgeted enough money to cover a commercial
> solution?
> While the simple answers are the ones that make sense to us technological
> people 
> 1> open source is good. 
> 2> personal satisfaction of putting your own system together 
> 3> It's just darn cool & techo-geeky. 
> 
> I believe;
> 
> 1. It's the best solution at any price.
> 
> 2. It provides more features than any other commercial application. 
> 
> 3. It's updated much more frequently than the commercial solutions. This is
> very important in accurately detecting spam. It's a race between the
> spammers and SpamAssassin and the ruleset writers. 
> 
> 4. It can use multiple virus scanners of your choice at the same time. This
> was very important today where a lot of folks got burned by a single virus
> scanner (thank you ClamAV!). Your virus scanners are updated hourly.
> 
> I'm sure you'll get a few other responses :)

I'll add to Steve's observations my own: 

The price was right. The bosses here at WeBuildHighways would have
devoted one full-time equivalent to this function in any event,
whether the solution was free or commercial, because we were being
swamped. The proposed solution would have required a Sun or RS/6K box,
and (I'm told) products that would have cost upward of US$30K/year in
license fees, as well as that same FTE.

My solution has been MailScanner, SpamAssassin, and ClamAV, all on
top of FreeBSD. Every bit and byte of it has been free, as have the
PeeCees, which were rescued from our to-surplus pile. The only costs
have been for power and my salary, both of which would have been costs
in any event.

I have far better control, don't have to worry about contract and
license expiration, and have at least as good support here and in the
SpamAssassin-Talk list as I've ever had from any contract vendor.
Ditto for FreeBSD and ClamAV. If they _insist_ on commercial support,
it's available for FreeBSD and (IIRC) for MailScanner, and ISTR it may 
be available for SpamAssassin as well. They don't have to use ClamAV; 
they can pay for something else that's not-quite-as-good. 

This stuff Just Works, and my bosses at all levels have expressed
complete satisfaction with the open-source solution. If you've got
money in the budget for a commercial solution, use some of it to
license the commercial AV scanners. See if the remainder can be used
for getting you more-and-better hardware. Show your bosses that you're
_saving_ money, and what you're spending is being spent wisely.

I'd turn the question around: when there's a good, free solution to
the problem, how can they justify paying for a commercial solution?
That's like going into a restaurant and buying a meal when it's
raining soup!

-- 
Mike Andrews
mikea at mikea.ath.cx
Tired old sysadmin