[Rspamd-Users] Announce: updated usage policies

[Vsevolod Stakhov]

On 26/03/2020 17:20, Kim Sindalsen via Users wrote:
> Hi,
> 
> Could the/some of the traffic be distributed? not that I'm on a
> 1000Mbit/1000Mbit fiber, but I wouldn't mind donating some bandwidth for
> queries or other stuff.
> 
> ie. something like pool.ntp.org?
> 
> Regards, 
> Kim Sindalsen 
> 
> -----Original Message-----
> From: Users <users-bounces at lists.rspamd.com> On Behalf Of Vsevolod Stakhov
> Sent: 26. marts 2020 11:52
> To: users at lists.rspamd.com
> Subject: Re: [Rspamd-Users] Announce: updated usage policies
> 
> On 26/03/2020 10:26, Ralf Hildebrandt wrote:
>> * Vsevolod Stakhov <vsevolod at rspamd.com>:
>>
>>> https://rspamd.com/doc/usage_policy.html
>>
>> I read this and found "Your query volume is less than 500,000 queries 
>> per day" -- how can I find out?
>>
>> I mean, I have an estimate of mails per day, but not every mail causes 
>> a query?
>>
> 
> Every email can cause multiple queries. Up to number of mime parts, so
> typically 2-3 requests. To be honest, a number of 500k per day is not really
> that stressing to my servers. For example, here are top abusers for the past
> hour (it means number of queries per HOUR, not per day):
> 
> 100282 -> ec2-xxx.amazonaws.com.
> 100462 -> ec2-xxx.amazonaws.com.
> 103506 -> ec2-xxx.amazonaws.com.
> 104731 -> ec2-xxx.amazonaws.com.
> 105071 -> ec2-xxx.amazonaws.com.
> 108695 -> ec2-xxx.amazonaws.com.
> 110228 -> ec2-xxx.amazonaws.com.
> 114882 -> ec2-xxx.amazonaws.com.
> 116070 -> cl1.cz.
> 116492 -> cl1.ru.
> 131540 -> cl1.org.
> 170795 -> cl1.com.
> 208224 -> cl1.net.
> 237264 -> cl1.com.
> 240696 -> cl1.com.
> 241190 -> cl1.com.
> 243925 -> cl1.com.
> 246105 -> cl1.com.
> 275484 -> cl2.com.
> 338169 -> cl2.ru.
> 341229 -> cl3.ru.
> 613716 -> cl2.ru.
> 798579 -> cl2.net
> 2097275 -> cl1.no.
> 
> So the top abuser sends 2M of queries per hour. In total, my fuzzy processes
> 12M of queries per hour (around 3-4k requests per second).
> Unfortunately it gets only worse with time... Apparently, those who sends 2M
> of requests per hour prevents other fair users to get their services
> available.

Thank you for your offer but it won't work.

Maps are distributed over HTTPS and are unsigned, so it is not possible
to build a distributed and secure system with untrusted peers. The same
is true for fuzzy hashes.

Furthermore, I prefer to have all my infrastructure under my control as
after all on any failure Rspamd users would come to me.

PS: please refrain from top-quoting in the list. Thank you.