convincing spam from CNN

[#1]

Quote

Plusnet still haven't started work on a solution

I'm almost 100% sure that this isn't true, but I;'ll try to get Bob to supply some details when he comes out of his meeting.

[#2]

Quote from: Jameseh

Quote I'm almost 100% sure

That's reassuring!

[#3]

Quote from: Gimpy

Plusnet should, at the very least, warn users by email that there is a problem and advise people not to open certain emails.

PlusNet DID send out a warning email on 5th August, but possibly only to people who have signed up to have Service Status emails sent (which I have).

[#4]

I can't see where you request service status emails but it seems I have it set to allow any old crap to be sent to me from plusnet. I don't remember getting that email though which, if you say was received on the 5th, was actually a day or 2 late.
Did anybody else get the email?

[#5]

MM is referring to this:
http://usertools.plus.net/status/archive/1217928134.htm
You can sign up for the Service Status RSS feed on the same page.

[#6]

Not late at all as the first one we got came through on the evening of 4th Aug. This discussion began on 5th when it became noticeable that they were a problem.

[#7]

Quote from: Barry

I think treating the X-pstn-xfilter: y  header to be spam is a good idea.  I've not had any false positives as yet, and it's been 100% successful in identifying the latest batch of CNN spam.

I agree and I'm currently in the process of trying to get the config changed. I'm hoping we can get this rolled live before the weekend. Assuming I can get this pushed through, all the CNN stuff should start getting identified as spam.

Quote from: driveconsultants

I don't think Postini should be ditched as a knee-jerk reaction unless there is something better. It is very good at detecting spam, but I have had a LOT of false positives. I now have over 100 entries in my white lists and I am still adding more even now. Adding to the lists is a clumsy and time-consuming process. I don't understand why Postini is so poor at passing on mails from genuine list addresses, it seems to be biased against mails going to multiple recipients. Even some mails from subscribers to my own PlusNet mailing lists gets caught as spam sometimes.

Don't get me wrong. I wasn't suggesting we move to another solution because of the CNN issue. If I'm honest we've been trialling alternatives for some time now. We already have one solution pretty much integrated into our network (all staff email accounts have been using it). The results are very impressive and almost entirely eliminate the false positives that you're referring to. Expect to hear more about our plans for the mail platform over the coming months.

Quote from: paulgul

Can we not have a better system for whitelisting / blacklisting such as buttons on the web mail page or perhaps incorporate it into the spam / not spam buttons so that marking a message as 'not spam' would automatically whitelist it for that user.

We're looking at the Webmail platform too as part of our plans for the email platform.
Apologies for the lack of input on this thread guys but please don't think that we're not listening to your concerns. We are, and as I've mentioned above I hope to have this particular issue sorted today.

[#8]

Ok sorry, I could have sworn I got my first one on Sunday but it does appear that the first sightings where on Monday evening, so, Plusnet weren't that slow afterall. I still don't remember getting any email but maybe it is my fault for not having an RSS client set up and running for the rare cases when there is some useful information to be displayed in it.
It still doesn't cover for the fact that the whole world started seeing this at the same time and a lot of the posts here are from people with other email provider accounts and aren't suffering with them as much as we all are with the plusnet email addresses

[#9]

Quote from: Bob

Don't get me wrong. I wasn't suggesting we move to another solution because of the CNN issue. If I'm honest we've been trialling alternatives for some time now. We already have one solution pretty much integrated into our network (all staff email accounts have been using it). The results are very impressive and almost entirely eliminate the false positives that you're referring to. Expect to hear more about our plans for the mail platform over the coming months.

Bob,
You will remember - probably the scars are still visible  - the problems when you rolled out Postini to the wider membership.
Would it be possible to offer it to volunteers first so that it can be tested in a non staff environment.

[#10]

Quote from: Bob

If I'm honest we've been trialling alternatives for some time now. We already have one solution pretty much integrated into our network (all staff email accounts have been using it). The results are very impressive and almost entirely eliminate the false positives that you're referring to. Expect to hear more about our plans for the mail platform over the coming months.

I don't really care what service provider/solution you opt for, the important thing is that it simply has to work.
At the moment I'm adding one or two addresses to the white list every two weeks - that is simply unacceptable. Adding senders to the black list isn't worth the time as real spammers never use the same address again. Yes I realise I can process my mail with rules based on the headers, but I don't really want the trouble, and that doesn't help for Webmail or email on my phone.

[#11]

Quote from: Oldjim

You will remember - probably the scars are still visible  - the problems when you rolled out Postini to the wider membership. Would it be possible to offer it to volunteers first so that it can be tested in a non staff environment.

Absolutely. In fact, this is probably possible now. The migration scripts are already in place from when we put staff accounts onto one of the alternatives. I'll ask around to see if we can move some domains across in the not-too-distant future.

Quote from: Username

I don't really care what service provider/solution you opt for, the important thing is that it simply has to work. At the moment I'm adding one or two addresses to the white list every two weeks - that is simply unacceptable.

I agree, and this is very much at the forefront of any decisions that will be made.

[#12]

I just use Sophos, its a rare day that I receive any spam, and I only recall one false positive on my account in the last three years of using Sophos.
So it is possible to get it almost right - (Sophos detects around 50% of the mail coming into our organisation as spam, and quarantines it for user action - only viral/infected messages are auto deleted.)
Trouble is, building a solution that works for home users at the right price.

[#13]

As if the Daily Top 10 wasn't a big enough pain,    I've now received  a message with the subject  'CNN Alerts: My Custom Alert'....

[#14]

Yeah, I've noticed that variant today too. All the ones I've seen though still contain the X-PSTN-Xfilter: y header, so spam tagging based on that should still catch these.

[#15]

Yes, they're all going into the special folder I made to catch anything in the 'y' category.