[prev in list] [next in list] [prev in thread] [next in thread] 

List:       spamassassin-users
Subject:    Abusive use of SARE sa-update channel resources
From:       "Daryl C. W. O'Shea" <spamassassin () dostech ! ca>
Date:       2007-05-24 5:17:55
Message-ID: 46552003.9070609 () dostech ! ca
[Download RAW message or body]

Howdy folks,

Just a friendly reminder that the *.sare.sa-update.dostech.net channels 
that I provide [1], for free, are intended for use with SpamAssassin's 
sa-update and not any half baked home brew solutions.

sa-update uses a light-weight method (that utilizes DNS) to determine 
when updates are available making it feasible for me to host the 100 
SARE channels at no cost to the community.  Unfortunately there have 
been an increasing number of people (currently a few hundred) who have 
decided to use wget/etc to retrieve all of the channel files that I host 
multiple times a day (in some cases every few minutes).  Many of the 
channel files have *never* had an update making such repeated retrievals 
purely abusive.  Some people are actually forging the user-agent value 
to make it look like they are using sa-update... so it's clear at least 
some of the abusers are aware that they are indeed abusing the service.

This abusive action now accounts for well over 95% of the traffic 
related to the channels.

If you must, for whatever reason, have your own archival copy of the 
SARE rules please use rules-du-jour to retrieve them from the Rules 
Emporium site [2].  Alternatively use sa-update to retrieve the channels 
and then archive the contents of your --updatedir.

If for some reason you need a local copy of the channels (say spamd 
servers with no web access) please do one of the following:

  - consider allowing at least limited http access to
    sare.sa-update.dostech.net for the SARE updates and
    spamassassin.kluge.net for the official SA updates
    (this is your best option... it'll save you a lot of work)

  - roll your own channels using the Rules Emporium site as the source
    for the rules

  - archive my channels in a non-brain-dead way, ie. pay attention to
    when files are updated (use DNS or at least the date stamps in the
    channel directory index)

Whatever your case, let this be notice that further abuse will, if 
necessary, result in the blockage of the abusive IPs and net blocks 
where appropriate.

For those of you only using sa-update to access the channels, please 
continue to do so and run sa-update as often as you want -- anywhere 
from hourly to daily is sane IMHO.


Regards,

Daryl


[1] http://daryl.dostech.ca/sa-update/sare/sare-sa-update-howto.txt
[2] http://www.rulesemporium.com/
[prev in list] [next in list] [prev in thread] [next in thread]