[ On Wednesday, April 30, 2003 at 13:01:07 (+0100), Alan J. Flavell wrote: ]
> Subject: Re: [Exim] Idea to slow down spammers
>
> The classic teergrube works by sending continuation lines at
> intervals: that way, you can spin out the response in units of a few
> minutes (less than the 5 minute timeout, I mean) for an hour or more.
Any such idea must make an almost infinite number of assumptions about
how the average spamware will behave.
Strictly speaking the protocol definition talks only about "responses",
with the assumption being that it means whole responses. As such the
client timeout applies only to whole responses, meaning that you cannot
assume that you'll be able to hold the client on the line for more than
the 5-minute timeout.
Now of course we are talking to some extent about specialized spamware
(though lots of spammers do just use a regular MTA), and so far I've not
seen any source code for any such custom coded critter, so it's hard to
say what the average one might do.
> Hmmm, I found that delaying by more than 5 minutes would result in
> the peer assuming that we were no longer responding, so they would
> disconnect.
>
> But as I say, the key to a real teergrube seems to be the ability to
> send a response as a series of continuation lines, separated by
> delays of a few minutes (less than 5). And I don't know how to do
> that with exim.
If they read character by character and reset their timeout timer every
time they get a character then it may be possible.
However, IIRC, most proper SMTP mailers will at best reset their timer
after ever line of a multi-line response, but some still only have an
outer timer for the whole response. Smail certainly does the latter.
--
Greg A. Woods
+1 416 218-0098; <g.a.woods@???>; <woods@???>
Planix, Inc. <woods@???>; VE3TCP; Secrets of the Weird <woods@???>
