Mods to Fuz2 seem to make it less effective

Vernon Schryver vjs@calcite.rhyolite.com
Thu Mar 6 23:20:30 UTC 2003


> From: Tim Wicinski <tim@meer.net>

> ...
> We've seen a similiar situation. We went from 1.1.8 to 1.2.22 and the 
> amount of spam has risen.  We were seeing a 60% blocking factor from 
> DCC, but that number has dropped below 50% and our local blacklists are 
> picking up the slack.

Those are very poor numbers.  Informants among your users have said
things that lead me to believe your DCC rejection threshold is well
above 200.  Are you rejecting only at "many" instead of a value far
less than 200 but still clearly "bulk"?  If so, is that because of
the difficulties of whitelists?   I think the right way to use the
DCC is with whitelists and a threshold below a few dozen.


> I also noticed the messages have more strings of random characters at 
> the beginning. I figured these are going to mutate enough to keep them 
> looking "unique".

Those are unlikely to matter to the FUZ2 checksum...enough said in public.


vjs



More information about the DCC mailing list

Contact vjs@rhyolite.com by mail or use the form.