However, my method still relies on the existing systems to identify the first few spam attempts. Once a particular host has attempted too many spammy things, it gets blocked by the firewall, and nothing else on the machine is going to see any kind of traffic from that source until the block expires.

So, SpamKarma (or any other spam detection tools) could be a part of an overall strategy along with my tools.

But maybe you already know Dave’s plug-ins and think that you’ve come up with a simpler or better concept. Then i would of course love to test yours.

Best regards, Thomas

The main thing that’s going to keep other people from using my code is that it requires your web server to have firewall support, and it requires you to have root access (in order to manipulate the firewall rules).

On the ‘pro’ side, an admin with the resources could modify it to distribute things a bit. You could have instances of the ipupdate piece running on different hosts, triggered by multiple services (web, mail, security logs, etc). They could all be configured to send updates to a common database. And they could also be modified to retrieve firewall state information from another, possibly centralized, source (like a border router).