Tony Finch wrote:
> > I'm doubtful that even a University is so uniform that sheer volume is
> > a sure fire indicator of wickedness
>
> You are right that I'm probably being optimistic, which is why I intend
> to do plenty of measurement before starting enforcement. Also, I'm not
> planning to use rate limiting as the sole or even the principle means of
> detecting bad behaviour, but mainly as an emergency backstop to protect
> against spewing hosts.
If I remember correctly, someone once posted a paper correlating the
volume sent with regards to invalid recipients and recipients per message,
and also to the general usage patterns seen from each client. It was
literally a three to four pronged approach, working on cumulative data by
building the info from the logs. ( BTW, if I am drifting off topic, let me
know. I have only lightly perused the thread since it started :) Whilst it
is a slow to build information scenario, it does seem to make a good long
term strategy. For subscribe, spam and run type situations, obviously not
much use due to the limited timespan.
Just thought the idea may be something to chew on.
