[bogofilter] using block_on_subnets

[tallison at tacocat.net]

> On Fri, 2004-04-30 at 06:33, Tom Allison wrote:
>> Just for grins, I rebuilt my wordlist using this subnets option
>> enabled.
>> My current database is about 50% larger than it was previously.
>> It will be interesting to see how it grows in the coming week.
>
> Using http://www.orderamidchaos.com/bogofilter/spamitarium, I've been
> inserting Autonomous System Numbers (ASNs) in all of my received lines,
> as this achieves the same basic goal as block_on_subnets, without the
> huge wordlist bloat.
>

What is an ASN?

>> I'm pretty certain that these are all invalid URL's.
>> I just surprised at how many of them are also "good"
>
> It's also possible that 0, 0.0, etc., were used in a different context
> than a URL, but bogofilter parsed it wrong.  It's also possible that
> some MTAs might print 0.0.0.0 when they fail to obtain a lookup for the
> correct IP.  My program throws away received lines without a valid IP,
> particularly IPs in reserved ranges, impossible IPs, and local IPs.
>
>> If it seems reasonable enough to start looking into more feasable
>> studies, then it might make sense to collect bogofilter wordlist
>> information from other peoples ^url: listings to see if there is
>> sufficient and consistent overlap to provide a reliable means of
>> detection.
>
> As I said before, I'm not using the block_on_subnets option due to the
> disk space considerations, but ASNs can achieve the same goal.  Here are
> some of my top scorers (>25 seen):
>

I read through some of the description/code of spamitarium and have one
comment.  The removal of some X-Headers could be "bad".  I love getting
X-List headers so I can filter on my mailing lists.  It also is useful to
keep X-Loop headers around to avoid other problems.