Anti-spear-phishing, round 2

Guy Story KC5GOI kc5goi at
Sat Jan 10 17:55:24 GMT 2009

Kai,  I need to clarify my question then.  I did read over the script and if I understand it, please bear in mind I do not pretend to program, that it downloads the data from Google and turns it into a rule for SA.  The rule itself provides inbound, outbound and content filtering using the email addresses that are provided by the Google list.  Between Jules postings and the comments in the script, if I am understanding it correctly, then that is a huge testimony on Jules commenting in the file.  That is a huge help for non-programmers and I thank him.

I understand that since I do not have the current release of MS that I can not take full advantage of what Jule has done.  I am currently using 7.10 of Ubuntu so I need to make sure that I can satisfy the dependencies to preform the upgrade.  This is a time issue since I am a one man department.

As a temporary solution I downloaded the list and used it to create a list that I added to my spam blacklist rule with FromOrTo so I can filter on two of three points. 

The downside to my current approach is lack of content scanning and a manual updating process instead of using Jules script in cron.hourly.  Not ideal but a start.  It takes me 5 minutes to do this where Jules script probably does in in less than 30 seconds (download, convert, copy and restart MS)  and is more current.  I might do this once a week.  I understand that the address list could update literally on an hourly basis.  The rate of updates is up to Google and I have not read through the project fully yet.

My original and poorly worded question was more along the lines of how much work MS has to do using the list of addresses in the spam blacklist verses a SA rule.  It it more work processing the blacklist than the SA rule?


----- Original Message -----
From: "Kai Schaetzl" <maillists at>
To: mailscanner at
Sent: Saturday, January 10, 2009 4:31:16 AM GMT -06:00 US/Canada Central
Subject: Re: Anti-spear-phishing, round 2

Guy Story KC5GOI wrote on Fri, 9 Jan 2009 12:57:38 -0600:

> I took the list from Google
> and massaged it to it fit the format for use as the spam.blacklist.rule
> file, is that any less efficient as far as MS is concerned?

Much less. Just read what Jules script does.


Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services:

MailScanner mailing list
mailscanner at

Before posting, read

Support MailScanner development - buy the book off the website! 

More information about the MailScanner mailing list