Spam/virus filtering ????

[greencreeper]

Originally Posted by Toto

Fact, ntl have introduced the first stage anti spam filtering (since late Nov 2004), which I believe is an agressive use of Realtime Blakck Lists, and also do antivirus scanning on inbound emails, and drop them if they are infected.

I just sent a virus to myself and it was quietly dropped by the mail system - the sender (me) never received a rejected email warning. This is not good - the email could have been legitimate.

[Toto]

Originally Posted by greencreeper

I just sent a virus to myself and it was quietly dropped by the mail system - the sender (me) never received a rejected email warning. This is not good - the email could have been legitimate.

But it wasn't, you sent a virus, ntl anti virus system picked it up as a virus and deleted it. Are you saying its bad because you did not get email notification that the email had been blocked, or that the email was dropped despite it having a virus?

[ian@huth]

I can see the point that greenkeeper is making. If he was a virus expert and a friend emailed him a virus to have a look at he would never get it even though he wanted it and expected it.

[greencreeper]

Originally Posted by ianathuth

I can see the point that greenkeeper is making. If he was a virus expert and a friend emailed him a virus to have a look at he would never get it even though he wanted it and expected it.

That would be a crime ianathuth

I meant that had I sent a legitimate email with a suspicious attachment, say, then I should be informed if the email is rejected as virus laden, otherwise I'll just assume it arrived and the recipient is ignoring me. And you know what humans are like - "Well he never responded to my email so he can get stuffed" and "Well she said she'd mail me those pics and I haven't got them. That's her with a one star rating in the black book"...

[Toto]

Originally Posted by greencreeper

That would be a crime ianathuth

I meant that had I sent a legitimate email with a suspicious attachment, say, then I should be informed if the email is rejected as virus laden, otherwise I'll just assume it arrived and the recipient is ignoring me. And you know what humans are like - "Well he never responded to my email so he can get stuffed" and "Well she said she'd mail me those pics and I haven't got them. That's her with a one star rating in the black book"...

You're correct of course.

I would assume there would be some situations where any virus check will throw up a false positive, and a legit email would be rejected.

I think though that ntl are just looking at a major problem for their customers, and deciding that it is not acceptable to allow emails with viruses being delivered to their customers. I know for example that if I need to get a file checked by symantec, I use their AV client, and its gets ftp'd away to them without the need to use SMTP, so I know that will be delivered.

I would have hoped that somebody working for tech support could have offered an opinion either way, perhaps a little customer feedback

[ian@huth]

Originally Posted by greencreeper

That would be a crime ianathuth

I meant that had I sent a legitimate email with a suspicious attachment, say, then I should be informed if the email is rejected as virus laden, otherwise I'll just assume it arrived and the recipient is ignoring me. And you know what humans are like - "Well he never responded to my email so he can get stuffed" and "Well she said she'd mail me those pics and I haven't got them. That's her with a one star rating in the black book"...

Why would it be a crime? Have you never sent a virus to Symantec or other antivirus software supplier for analysis?

[darren]

I know that Wanadoo have a decent solution to spam, they mark each message that looks like spam by adding ***SPAM*** at the beginning of the subject.

The user then decides what to do with it. Delete it straight away or downloaded it to check it, I've never had a false positive from them either. I also don't have to use SpamPal to scan emails from Wanadoo which saves time.

Personally I think having emails deleted on the server that contain viruses isn't a good thing, we should a least get a messages saying its happened or possibly get the email without the attachment, and at best, have the attachment cleaned if it is possible.

[greencreeper]

Originally Posted by ianathuth

Why would it be a crime? Have you never sent a virus to Symantec or other antivirus software supplier for analysis?

Well you are knowingly transmitting something nasty and you cannot consent to being infected AFAIK I've encountered a virus maybe two or three times in the many years since I started using computers. I just don't get them

[Toreador]

Originally Posted by Toto

Fact, ntl have introduced the first stage anti spam filtering (since late Nov 2004), which I believe is an agressive use of Realtime Blakck Lists, and also do antivirus scanning on inbound emails, and drop them if they are infected.

Hmmm. I'm getting more spam than ever, now around 100 per day. And have received 5 virus-bearing emails this week alone. So whatever they're doing isn't terribly effective.

I'm an experienced user, block spam/viruses myself using various products, but would welcome some decent server side blocking from NTL. So long as it's configurable in some way, or leaves the filtered emails available somewhere, or whatever, I can't see any arguments against it.

[Toreador]

Originally Posted by greencreeper

I meant that had I sent a legitimate email with a suspicious attachment, say, then I should be informed if the email is rejected as virus laden

So if a spammer sends an email containing a virus to a pile of randomly generated addresses, they'll get a handy message from all the valid ones telling them the email was rejected but the address is OK

Anyone know what NTL: Business does with its email service? Do they filter in the same way? I ask because a) I'm not convinced that both my outgiong and incoming mails may get caught up in the filter, without me being informed of a delivery failure and b) I still lack faith in NTL: Home's email service, despite the servers managing to stand up for a few weeks at a time recently. Oh and NTL: Business provides a service guarantee which Home doesn't.

Had a thought. Would it make sense to allow users to block mails which feature specific key words. Looking at the junk that still clogs up my Spam box, blocking mails featuring the words Viagra, Cialis, Vicodin, Rolex, teen, sluts or phrases such as 'premature ejaculation' would greatly reduce my unwanted mails. Could someone plenty more kneolwedge of how the networks work advise if this a practical/useful suggestion for reducing unwanted traffic and, therefore, strain on servers?!

[dragon]

Originally Posted by darren

I know that Wanadoo have a decent solution to spam, they mark each message that looks like spam by adding ***SPAM*** at the beginning of the subject.

ahh but they also BLOCK smtp traffic on port 25 to anything other than THEIR smtp server (they claim its to stop spam) although this can be got around by using a different port its rather a pain.

[Toto]

Originally Posted by andyl

Oh and NTL: Business provides a service guarantee which Home doesn't.

Not sure about your other points andyl, but ntl's Service Level Agreement for Business has to do with conectivity to the network, it does not cover serviices such as email.

I believe that business users on the cable network that do not have a leased static IP address must use smtp.ntlworld.com in order to send email just like residential customers.
____________

Originally Posted by andyl

Had a thought. Would it make sense to allow users to block mails which feature specific key words. Looking at the junk that still clogs up my Spam box, blocking mails featuring the words Viagra, Cialis, Vicodin, Rolex, teen, sluts or phrases such as 'premature ejaculation' would greatly reduce my unwanted mails. Could someone plenty more kneolwedge of how the networks work advise if this a practical/useful suggestion for reducing unwanted traffic and, therefore, strain on servers?!

Rules can be set up to do this using your own email client, but spammers often spell such spamming words in such a way to trick spam filters. As an example they may spell viagra v1agra, or even v iagr a, with deliberate spelling mistakes and gaps in the letters.

Essentially this would mean that you as the user would have to create hundreds of rules, which is impractical, and can lead to problems in how your email client filters email.

I believe that ntl will introduce additional technology in the coming months to augment their current spam filtering, I think it may even be the Brightmail solution, but I could be wrong. Whatever it is, it will no doubt use lists of words similar to the ones you have mentioned in order to reduce spam, but in a more intelligent way.

For example you may get an email from a spammer stating "buy viagra from our online chemist" in the body, and get another email from your best friend who informs you that he has "started to use viagra" in order to spruce up his love life. Which one do you filter based on the word viagra?

That is the problem that faces spam filtering techology, which means that ntl, and any other network that employs content based filtering needs to offer the user the chance to review any email it considers to be spam, and not just drop it because of a probability that the email IS spam.

Of course, whilst the offer to buy viagra may actually be spam, it could be something that the recipient is interested in. One mans meat is another mans poison.

Cheers Toto, impressively comprehensive answer. Following on, so is NTL: Business's email just as spasmodically unreliable as NTL: Home's? That seems pretty incredible (although my capacity to be surprised by NTL is severely diminished these days).