Spam filter recommendations?

April 13, 2004 10:44 PM

God damn the spam. What spam filter would you recommend?
posted by Termite to Computers & Internet (26 answers total)

Spamassassin is my preferred option.
posted by Nick Jordan at 11:07 PM on April 13, 2004

PopFilter. It's upward 97+% accurate on my system after a year of use. Took a few weeks to crack the 90% barrier, been sailing ever since.
posted by five fresh fish at 11:09 PM on April 13, 2004

SpamBayes works pretty well for me (Outlook 2000/WinXP). Needs training first so save that spam.
posted by cbrody at 11:10 PM on April 13, 2004

knowspam.net has been a godsend. it's taken out about 3,000 spams in the last four or five months.
posted by amandaudoff at 11:16 PM on April 13, 2004

If you have your own MTA (you'd know what this is if you do -- if you don't, you definitely don't have one) you want SpamAssassin. Otherwise you just want client-side handling of spam, which just about every decent mail reader will do -- I hear the filters in Thunderbird and Mac OSX Mail.app are pretty good.
posted by majick at 11:40 PM on April 13, 2004

I'm using Spamsieve and it's wonderful. You have to use OS X, though. It works with just about any e-mail program on OS X. I use it with Eudora. It works better than Eudora's Spamwatch, and it's a lot cheaper, too. Mine is running 99.4% correct now. It is getting heavy use, too -- 300 spams/day (I have several publicly viewable addresses, plus my business address).
posted by litlnemo at 11:45 PM on April 13, 2004

SpamSieve gets about 90% for me, but then, I only feed it the messages that make it through my other spam filtering, which means it only gets to see dubious messages as input.
posted by kindall at 12:38 AM on April 14, 2004

No one's mentioned Mozilla. With Baynesian filtering built into the mail app, why use a 3rd party application when it can be built right into your email app?

After a week of training, I hardly got to see any spam at all anymore. I miss my daily dose of penis enlargement pills and viagara.
posted by SpecialK at 1:16 AM on April 14, 2004

popfile worked very well for me, but it's very memory hungry. If you've got enough memory in your machine, then I highly reccomend it. I've swapped from using popfile to the Baysian filtering used by Thunderbird, and it's not half as good.
posted by seanyboy at 4:43 AM on April 14, 2004

The Junk Mail filter in Outlook 2003 works really well for me, FWIW.
posted by viama at 5:09 AM on April 14, 2004

I did not like the Baysian filters I tried, but I have had a lot of success with SpamNet. It is for Outlook (and Outlook Express?) and it is based on user identification of spam messages. The first year of service was a little choppy while they worked the kinks out (too many users identified legitimate newsletters as spam), but now it is great. No false positives in the last 5-6 months.

It is a pay service (after a period of a free trial).
posted by Tallguy at 6:08 AM on April 14, 2004

another vote for popfile. it was annoyingly innaccurate in the beginning, flagging legitimate email as spam, and now, only rarely flags spam as real. It's now up to 99.68% accurate, according to my stats, misclassifying a mere 105 messages out of 33,103 total.

Oh, and it's free.
posted by crunchland at 6:12 AM on April 14, 2004

I use popfile, and it works great. Almost 100,000 messages have passed through the filter, with only 8,000 of them being legitamate non-spams. 99.88% accuracy, which would probably be slightly better if I was more active with telling the program about the false negatives/positives, of which there have been very few..
posted by skwm at 6:12 AM on April 14, 2004

For Mail.app on OS X, I highly recommend adding to program's built-in junk filter Ben Han's free Junk Matcher. I don't have exact numbers, but my false positives are one or two a week (because I get a lot of legitimate mail from strangers and so can't white list them in advance), and false negatives are about one a month. I average about 100 spam messages a day (though this fluctuates).
posted by Mo Nickels at 7:30 AM on April 14, 2004

I use SpamAssassin and Apple Mail's built-in filter. I have to re-train Apple's filter about twice a year, which is annoying, but when it works, the two together are awesome.
posted by mkultra at 7:34 AM on April 14, 2004

I use plain old procmail with my shell account email. It's not for everyone but I find that I have complete and total control over what goes where. I use it for filtering my mailing lists, re-routing my domain-based mail, tossing out spam and quarantining all those pifs and exes that seem to make it to my inbox. FWIF, I've found that the number one most useful way to trap spam in my little set-up is to filter out email that is not from one of about 10-15 known user agents [aka email programs: Eudora, elm, pine, mutt, Outlook, etc]. Very few if any spammers that harass me use any known major mail agent.
posted by jessamyn at 7:47 AM on April 14, 2004

wow. so simple. I'm wondering if you've had issues with blocking legitimate email by blocking all but those user agents?
posted by crunchland at 8:15 AM on April 14, 2004

I'm wondering if you've had issues with blocking legitimate email by blocking all but those user agents?

Yes, rarely. Most of those people are either a) regular correspondents who I can then whitelist from then on, or b) random emailers who I don't mind digging out of my spam box and replying to a day or so late. The thing to remember with this technique is that if you have mailto forms that you get correspondence via, you need to make sure they either send a user agent that is whitelisted, or have some other trigger that can get them sent ot the inbox not the spambox. I am now wondering if I can scour headers for "in-reply-to" tags and have all the replies to email I send out automagically get put into my inbox. Anyone know?
posted by jessamyn at 8:22 AM on April 14, 2004

i use procmail to implement:
- whitelisting of known good people/lists
- blacklisting of known bad people/subjects
- dumping anything over a certain size into a "large" folder
- filtering via dns lookup on blacklists (5 of them)
- spamassassin (with bayes and razor, i think, although i've not actually checked it's working)
in that order, with spam dumped in a folder named by the filter. i just downloaded 800 emails (my server had been down for 4 or 5 days) and got a couple of spam in my inbox; i would guess over half the incoming mail was spam so that's better (lower) than 1% getting through. the only thing that gives false positives worth checking for is the filter on size.

if you want a copy of the procmail recipe post here or drop me an email (this is on linux of course).
posted by andrew cooke at 10:12 AM on April 14, 2004

Add some rules to your e-mail program's filters, if you're allowed to do such a thing:

1. If Content-Type contains "text/html", sender is not in my address book, and sender is not in my previous recipients, move to Junk.

2. If Content-Type contains "multipart", sender is not in my address book, and sender is not in my previous recipients, move to Junk.

I have a third rule in place that says if the sender is in my address book and in my previous recipients, then run a script that tells Mac OS X to speak: "You have new mail from $sender." With these three rules in place I never, ever see messages in my inbox from people I don't know. Spam problem solved completely.
posted by emelenjr at 11:20 AM on April 14, 2004

jessamyn - there's an example in one of the procmail man pages to do with catching duplicate incoming messages that you could probably adapt (man procmailex, text starts "If you are subscribed to several mailinlists")
posted by andrew cooke at 12:44 PM on April 14, 2004

I still use a simple procmail challenge-response whitelist that I wrote years ago and it works beautifully.
posted by nicwolff at 1:49 PM on April 14, 2004

I'm using bogofilter, which is light and works wonderfully for me.
posted by fvw at 3:59 PM on April 14, 2004

I used to use bogofilter, but I was a bit lax about maintaining my corpii, and I ended up spending too much time going through my spam bucket looking for things that I needed to retrain it on. It also STM that this really isn't all that great an application for decentralized Bayesian sorting -- we all get the same spam, why should we each stress over training a million and one Bayesian agents on what it looks like? Now, if there were a Bayesian mail sorter with a much more general interface that would learn about my broad mail types and put them in logical places, I'd like it.

Anyway, I'm currently using Active Spam Killer, which is a challenge/response based system. After an initial period of a couple weeks of diligently watching my queue to catch any automated mail that I wanted filtered, it's now in cruise-control mode, and I have a false negative rate of 0%. (And, as long as I remember to seed the whitelist with any new addresses I'm planning on receiving mail from that aren't people, a false positive rate of 0%, as well)

A more comprehensive tool along the same lines is TMDA.
posted by jammer at 4:24 PM on April 14, 2004

Response by poster: A late thank you to all who responded to this question. I will study your answers.
posted by Termite at 11:21 AM on April 15, 2004

STM? Short Term Memory? Scanning Tunneling Microscope?

As for decentralisation, yes we all get the same spam (well, apart from spam which only goes to specific TLD's). But the big difference is we all get wildly different "ham" (non-spam) mail. And it turns out that's quite an essential part of the bayesian classification equation.
posted by fvw at 2:38 AM on April 16, 2004