4 ms·

Rspamd 1.2: Fast, free and open-source spam filtering system

44 points by cebka 11y ago

dochtman 11y ago
I've started using this a few months ago on my mail server that mostly just forwards stuff to GMail, and it's been really good. It catches (and rejects) most of the bad stuff before it even ends up in GMail's filters and, more importantly, this means my forwarding server doesn't get rate-limited anymore by GMail for sending so much spam. I've been packaging rspamd for Gentoo, and it's pretty straightforward to build and run (more so now if you run Gentoo, of course), so that's good too.
- blakesterz 11y ago
  This is the first time I've seen rspamd, looks interesting, do you find it better than spamassassin?
  - cebka 11y ago
    My opinion is definitely not very objective as I'm the author of this project, however, I tried to do some recent comparison of rspamd vs SA: https://rspamd.com/misc/2016/03/03/rspamd-performance.html https://rspamd.com/misc/2016/03/03/rspamd-performance.html and there is another 3-rd party opinion here: https://github.com/haraka/Haraka/pull/964#issuecomment-100694945 https://github.com/haraka/Haraka/pull/964#issuecomment-10069.... In brief, rspamd can use the most of SA rules but it provides more optimization tricks than SA does. However, it is less mature and could be harder to setup than SA. You can also check my recent FOSDEM talk: https://www.youtube.com/watch?v=_fl9i-az_Q0 https://www.youtube.com/watch?v=_fl9i-az_Q0 I'm really sorry that this information is not in the landing page of rspamd.com - that's obviously my fault.
    - jlgaddis 11y ago
      You may already have this posted somewhere, but a feature comparison between SA and rspamd would be very handy.
      - cebka 11y ago
        Well, I've recently ported a massive setup of SA rules and I've tried to add all functions that are supported by SA to rspamd. The only ones unsupported are pyzor/razor/dcc (all that is covered by fuzzy check: https://rspamd.com/doc/modules/fuzzy_check.html https://rspamd.com/doc/modules/fuzzy_check.html). Both systems support statistics (rspamd uses 5-gramms hidden Markov model and SA uses naive bayes), they both support different backends for statistics (redis and sqlite for rspamd), per-user statistics, autolearning. Among network checks, they support URIBLs, RBLs, DMARC, DKIM, SPF. Obviously, both systems support regexp rules. However, I'm not an expert in SA features and might thus miss something...
      - darklajid 11y ago
        And since the author's already here: A similar comparison between rspamd and dspam would be neat as well - I remember that I stumbled upon rspamd in the past, but went with dspam for some reason. I think it was either related to learning (but rspamd can do that, right?) or the db backend (I didn't want to run multiple database backends and anything that didn't support postgresql was out right away). Then again, I might be completely off.
jlgaddis 11y ago
Anyone using this in a large environment care to comment on how it compares to SpamAssassin, especially with regard to per-user settings and false negatives/false positives?
brightball 11y ago
This looks really solid. I know one of the big methods to work around something like this is to change the destination of included links after successful delivery. Does this provide a way to replace links in a message so that they can be evaluated on click for continuous protection? Optionally of course since this would be more of a company policy type of protection than anything else.
- cebka 11y ago
  Rspamd itself does not alter message in any way. However, it keeps all urls with their relative positions during scan. Moreover, it can resolve redirects for urls (e.g. for t.co or goo.gl) and provide 'real' links. But the second part of job: links analysis and rewriting is not provided by rspamd.
kev009 11y ago
The code is really refreshing, not surprising since the author is a BSD developer :)
coverband 11y ago
The level of documentation for this project is super-impressive, especially since it seems to be mainly a one-man effort. Great job on this, congrats! (Apologies in advance to other contributors if I was incorrectly discounting their efforts; I made an assumption based on the number of commits on the repo.)

44 points by cebka 11y ago

I've started using this a few months ago on my mail server that mostly just forwards stuff to GMail, and it's been really good. It catches (and rejects) most of the bad stuff before it even ends up in GMail's filters and, more importantly, this means my forwarding server doesn't get rate-limited anymore by GMail for sending so much spam. I've been packaging rspamd for Gentoo, and it's pretty straightforward to build and run (more so now if you run Gentoo, of course), so that's good too.

blakesterz 11y ago
This is the first time I've seen rspamd, looks interesting, do you find it better than spamassassin?
- cebka 11y ago
  My opinion is definitely not very objective as I'm the author of this project, however, I tried to do some recent comparison of rspamd vs SA: https://rspamd.com/misc/2016/03/03/rspamd-performance.html https://rspamd.com/misc/2016/03/03/rspamd-performance.html and there is another 3-rd party opinion here: https://github.com/haraka/Haraka/pull/964#issuecomment-100694945 https://github.com/haraka/Haraka/pull/964#issuecomment-10069.... In brief, rspamd can use the most of SA rules but it provides more optimization tricks than SA does. However, it is less mature and could be harder to setup than SA. You can also check my recent FOSDEM talk: https://www.youtube.com/watch?v=_fl9i-az_Q0 https://www.youtube.com/watch?v=_fl9i-az_Q0 I'm really sorry that this information is not in the landing page of rspamd.com - that's obviously my fault.
  - jlgaddis 11y ago
    You may already have this posted somewhere, but a feature comparison between SA and rspamd would be very handy.
    - cebka 11y ago
      Well, I've recently ported a massive setup of SA rules and I've tried to add all functions that are supported by SA to rspamd. The only ones unsupported are pyzor/razor/dcc (all that is covered by fuzzy check: https://rspamd.com/doc/modules/fuzzy_check.html https://rspamd.com/doc/modules/fuzzy_check.html). Both systems support statistics (rspamd uses 5-gramms hidden Markov model and SA uses naive bayes), they both support different backends for statistics (redis and sqlite for rspamd), per-user statistics, autolearning. Among network checks, they support URIBLs, RBLs, DMARC, DKIM, SPF. Obviously, both systems support regexp rules. However, I'm not an expert in SA features and might thus miss something...
    - darklajid 11y ago
      And since the author's already here: A similar comparison between rspamd and dspam would be neat as well - I remember that I stumbled upon rspamd in the past, but went with dspam for some reason. I think it was either related to learning (but rspamd can do that, right?) or the db backend (I didn't want to run multiple database backends and anything that didn't support postgresql was out right away). Then again, I might be completely off.

jlgaddis 11y ago

Anyone using this in a large environment care to comment on how it compares to SpamAssassin, especially with regard to per-user settings and false negatives/false positives?

brightball 11y ago

This looks really solid. I know one of the big methods to work around something like this is to change the destination of included links after successful delivery. Does this provide a way to replace links in a message so that they can be evaluated on click for continuous protection? Optionally of course since this would be more of a company policy type of protection than anything else.

cebka 11y ago
Rspamd itself does not alter message in any way. However, it keeps all urls with their relative positions during scan. Moreover, it can resolve redirects for urls (e.g. for t.co or goo.gl) and provide 'real' links. But the second part of job: links analysis and rewriting is not provided by rspamd.

kev009 11y ago

The code is really refreshing, not surprising since the author is a BSD developer :)

coverband 11y ago

The level of documentation for this project is super-impressive, especially since it seems to be mainly a one-man effort. Great job on this, congrats! (Apologies in advance to other contributors if I was incorrectly discounting their efforts; I made an assumption based on the number of commits on the repo.)