Is amavisd-new still being maintained?

[Ralph Seichter]

Hello list members.

Does anybody here know if Mark Martinec (or anybody else) is actively
maintaining amavisd-new? https://www.ijs.si/software/amavisd/ has last
been updated more than two years ago, with the 2.11.0 release. The link
to the "Freshmeat project page" [1] points to information which is even
more outdated.

Since amavisd-new 2.11.0 contains a known bug which breaks DKIM signing
for outbound email (for which I created a Gentoo Linux pull request with
the recommended patch), I'd really like to get in touch witch whoever
can implement a fix in the original software.

-Ralph

[1] http://freshmeat.net/projects/amavisd-new/

[@lbutlr]

Post by Ralph Seichter
Does anybody here know if Mark Martinec (or anybody else) is actively
maintaining amavisd-new? https://www.ijs.si/software/amavisd/ has last
been updated more than two years ago, with the 2.11.0 release. The link
to the "Freshmeat project page" [1] points to information which is even
more outdated.

This does seem like a good question.

If amavisd-new is not being maintained is there something similar that is? Preferably not written in Perl?

(Sorry perl lovers, but perl is pretty damn taxing on my machines)

[Giovanni Bechis]

Post by @lbutlr

Post by Ralph Seichter
Does anybody here know if Mark Martinec (or anybody else) is actively
maintaining amavisd-new? https://www.ijs.si/software/amavisd/ has last
been updated more than two years ago, with the 2.11.0 release. The link
to the "Freshmeat project page" [1] points to information which is even
more outdated.

This does seem like a good question.
If amavisd-new is not being maintained is there something similar that is? Preferably not written in Perl?

I think that if Mark Martinek is not maintaining any more the community should step up and fork the
project.
Even if it has some bugs and some features are not completed I think it's a good product and moving to a
different project IMHO it's not in the spirit of open source software development.
Giovanni

[Ralph Seichter]

Post by Giovanni Bechis
I think that if Mark Martinek is not maintaining any more the
community should step up and fork the project.

Are you volunteering? I've made some local modifications over time, but
amavisd-new with its >35000 lines of monolithic Perl is not something
I would fork. If there is no more active development (I still hope there
is), I doubt that reviving amavisd-new, now that two years have gone by,
would be a good idea.

-Ralph

[Indunil Jayasooriya]

Zimbra also comes with it. What will be zimbra's future? What about
spamtitan?

Post by Ralph Seichter

Post by Giovanni Bechis
I think that if Mark Martinek is not maintaining any more the
community should step up and fork the project.

Are you volunteering? I've made some local modifications over time, but
amavisd-new with its >35000 lines of monolithic Perl is not something
I would fork. If there is no more active development (I still hope there
is), I doubt that reviving amavisd-new, now that two years have gone by,
would be a good idea.
-Ralph

[Giovanni Bechis]

Post by Ralph Seichter

Post by Giovanni Bechis
I think that if Mark Martinek is not maintaining any more the
community should step up and fork the project.

Are you volunteering? I've made some local modifications over time, but
amavisd-new with its >35000 lines of monolithic Perl is not something
I would fork. If there is no more active development (I still hope there
is), I doubt that reviving amavisd-new, now that two years have gone by,
would be a good idea.

IMHO amavisd installations number make this software too "big" to be killed.
If noone is maintaining this project somebody will have to take it, if
there is no future maybe importing it as an Apache project could be a good start.
Giovanni

[Bernhard Schmidt]

Hi,

I think a good start would be to import the past amavisd-new releases into Github / Gitlab and start collecting issues and pull requests for bugfixes. Not really merge them or even do a new release (which is a fork needing manpower and coordination to avoid fragmentation), but as a central point for known defects and patches floating around on the mailing list.

If no one steps up I can do this.

Bernhard

Post by Giovanni Bechis

Post by Ralph Seichter

Post by Giovanni Bechis
I think that if Mark Martinek is not maintaining any more the
community should step up and fork the project.

Are you volunteering? I've made some local modifications over time, but
amavisd-new with its >35000 lines of monolithic Perl is not something
I would fork. If there is no more active development (I still hope there
is), I doubt that reviving amavisd-new, now that two years have gone by,
would be a good idea.

IMHO amavisd installations number make this software too "big" to be killed.
If noone is maintaining this project somebody will have to take it, if
there is no future maybe importing it as an Apache project could be a good start.
Giovanni

[Ralph Seichter]

Post by Bernhard Schmidt
Not really merge them or even do a new release (which is a fork
needing manpower and coordination to avoid fragmentation), but as a
central point for known defects and patches floating around on the
mailing list.

Would that not only give a false sense of amavisd-new being maintained
after all? I still hope Mark Martinec will answer (I mailed him today)
and tell us where things stand.

Should amavisd-new have indeed become stale, I'll look into alternatives
like rspamd, which Ralf Hildebrandt already mentioned.

-Ralph

[Boris Gulay]

Post by Ralph Seichter
Would that not only give a false sense of amavisd-new being maintained
after all? I still hope Mark Martinec will answer (I mailed him today)

I've sent him a letter with some fixed more then two month ago. Still no
reply.
Just check when last version was released. It should tell you that
amavisd is actually dead.

[Dave McGuire]

Post by Boris Gulay

Post by Ralph Seichter
Would that not only give a false sense of amavisd-new being maintained
after all? I still hope Mark Martinec will answer (I mailed him today)

I've sent him a letter with some fixed more then two month ago. Still no
reply.
Just check when last version was released. It should tell you that
amavisd is actually dead.

Still works fine here. Personally I rather like it when a piece of
infrastructure software stops being a "moving target".

-Dave

[Ralph Seichter]

Personally I rather like it when a piece of infrastructure software
stops being a "moving target".

I like to know if software currently used in production systems is
maintained, i.e. how likely it is that bugs will be fixed in a
reasonable amount of time.

You can always decide not to update to newer versions if you like, but
if there are no newer versions available, you're S.O.L. ;-)

-Ralph

[Dave McGuire]

Post by Ralph Seichter

Personally I rather like it when a piece of infrastructure software
stops being a "moving target".

I like to know if software currently used in production systems is
maintained, i.e. how likely it is that bugs will be fixed in a
reasonable amount of time.
You can always decide not to update to newer versions if you like, but
if there are no newer versions available, you're S.O.L. ;-)

Agreed 100%...but are there any bugs in amavisd-new that anyone cares
about at this point?

-Dave

[Ralph Seichter]

are there any bugs in amavisd-new that anyone cares about at this
point?

Yes, DKIM-related, see my original message. From what I can tell the
available patch does not fix everything. Because of this issue I have
disabled amavisd-new's DKIM-features locally and use OpenDKIM.

-Ralph

[Tom Sommer]

Post by Ralph Seichter

are there any bugs in amavisd-new that anyone cares about at this
point?

Yes, DKIM-related, see my original message. From what I can tell the
available patch does not fix everything. Because of this issue I have
disabled amavisd-new's DKIM-features locally and use OpenDKIM.

Which is a perfectly fine solution, since it's not really an Amavis-job
to handle DKIM.

--
Tom

[Ralph Seichter]

[OpenDKIM] is a perfectly fine solution, since it's not really an
Amavis-job to handle DKIM.

And who gave you the mandate to decide what is and what is not "an
Amavis-job"? ;-) See https://www.ijs.si/software/amavisd/#features --
amavisd-new is designed to handle DKIM, did so in versions 2.10.x, and
partially broke it in 2.11.0.

Oh, and of course OpenDKIM is fine. Most features of amavisd-new can be
replaced by using other software, which may even be better at it. I am
now actively looking into phasing out amavisd-new.

-Ralph

[David Newman]

Post by Dave McGuire

Post by Ralph Seichter

Personally I rather like it when a piece of infrastructure software
stops being a "moving target".

I like to know if software currently used in production systems is
maintained, i.e. how likely it is that bugs will be fixed in a
reasonable amount of time.
You can always decide not to update to newer versions if you like, but
if there are no newer versions available, you're S.O.L. ;-)

Agreed 100%...but are there any bugs in amavisd-new that anyone cares
about at this point?

I do. As currently implemented amavisd-new doesn't handle perl doubles
as doubles, and requires a pretty old (< 4.038) version of the DBD-MySQL
module to work; that version has other issues.

I've noted this previously on this list, and it's also detailed in this
thread:

https://de.postfix.org/pipermail/amavis-users/2017-January/004711.html

dn

[@lbutlr]

Post by Dave McGuire
Still works fine here. Personally I rather like it when a piece of
infrastructure software stops being a "moving target".

When ut us supposed to be dealing with the constantly movie target of malicious emails, no, I don’t like to see it stop updating.

Besides that, there are some pretty serious bugs in amavis-new that have not been addressed.

In fact, I do not currently have it installed.

[Ralf Hildebrandt]

[Alexander Dalloz]

We recently migrated away from amavisd-new and are now using rspamd.

That's too a one man show?

Alexander

[Ralph Seichter]

Post by Alexander Dalloz
That's too a one man show?

See https://github.com/rspamd/rspamd/blob/master/AUTHORS.md

-Ralph

[Benny Pedersen]

Post by Ralph Seichter

Post by Alexander Dalloz
That's too a one man show?

See https://github.com/rspamd/rspamd/blob/master/AUTHORS.md

impresive that amavisd have less tickets

[Boris Gulay]

Post by Benny Pedersen

Post by Ralph Seichter

Post by Alexander Dalloz
That's too a one man show?

See https://github.com/rspamd/rspamd/blob/master/AUTHORS.md

impresive that amavisd have less tickets

Because rspamd is actively maintained. Amavisd is not.

[Benny Pedersen]

Post by Boris Gulay

Post by Benny Pedersen

Post by Ralph Seichter

Post by Alexander Dalloz
That's too a one man show?

See https://github.com/rspamd/rspamd/blob/master/AUTHORS.md

impresive that amavisd have less tickets

Because rspamd is actively maintained. Amavisd is not.

this does not hold water, since it could aswell be that amavisd is more
stable then rspamd

i have being using both at diffrent times, got more simple setup with
clamav-milter and spampd

[Boris Gulay]

This post might be inappropriate. Click to display it.

[Tom Sommer]

Post by Boris Gulay

Post by Benny Pedersen

Post by Boris Gulay

Post by Benny Pedersen

Post by Ralph Seichter

Post by Alexander Dalloz
That's too a one man show?

See https://github.com/rspamd/rspamd/blob/master/AUTHORS.md

impresive that amavisd have less tickets

Because rspamd is actively maintained. Amavisd is not.

this does not hold water, since it could aswell be that amavisd is
more stable then rspamd
i have being using both at diffrent times, got more simple setup with
clamav-milter and spampd

Looks like it was long ago. rspamd can now also be installed as a
filter and it works "out of the box".
And one more impotent advantage of rspamd: it gives you access to
global SPAM databases like fuzzy and so on. Just take a look at
default config files. It improves spam detection of freshly installed
system.

The problem is that if you've built an entire system/cluster, UI etc.
etc. based on Amavis - it's not really plug-n-play to just change to
rspamd.

Also rspamd replaces spamassassin, so you are looking at a change in
spamfiltering technology/ruleset/config as well.

[Marco]

Hello,
I use Amavis as interface to Spamassassin and DSPAM, using the
Spamassassin DSPAM plugin.

This setup is very useful to have a global spam protection and a fast
per-user learn "on error" (DSPAM), configured through LDAP.
With the LDAP ExtLookupDriver I can map all mailboxes aliases on each
own account. With Spamassassin rules I can tune all different
contributes to the final score. (I don't like Spamassassin learn, I
prefer an "on error" approach, which is more reactive and doesn't
require initial learns).

Move this design on rspamd is not easy. I think rspamd is not a magic
wand to easily replace Amavis&c.

I hope Amavis could still be maintained. DSPAM is already gone. If also
Amavis dies, Spamassassin will follow...

Regards
Marco

Post by Tom Sommer

Post by Boris Gulay

Post by Benny Pedersen

Post by Boris Gulay

Post by Benny Pedersen

Post by Ralph Seichter

Post by Alexander Dalloz
That's too a one man show?

See https://github.com/rspamd/rspamd/blob/master/AUTHORS.md

impresive that amavisd have less tickets

Because rspamd is actively maintained. Amavisd is not.

this does not hold water, since it could aswell be that amavisd is
more stable then rspamd
i have being using both at diffrent times, got more simple setup with
clamav-milter and spampd

Looks like it was long ago. rspamd can now also be installed as a
filter and it works "out of the box".
And one more impotent advantage of rspamd: it gives you access to
global SPAM databases like fuzzy and so on. Just take a look at
default config files. It improves spam detection of freshly installed
system.

The problem is that if you've built an entire system/cluster, UI etc.
etc. based on Amavis - it's not really plug-n-play to just change to
rspamd.
Also rspamd replaces spamassassin, so you are looking at a change in
spamfiltering technology/ruleset/config as well.

[Ralf Hildebrandt]

Post by Marco
I hope Amavis could still be maintained. DSPAM is already gone. If also
Amavis dies, Spamassassin will follow...

Especially since Mark is/was active in both amavisd and SpamAssassin!

[Henrik K]

Post by Ralf Hildebrandt

Post by Marco
I hope Amavis could still be maintained. DSPAM is already gone. If also
Amavis dies, Spamassassin will follow...

Especially since Mark is/was active in both amavisd and SpamAssassin!

You can't compare one-man shop to a proper Apache open-source project. Some
committers will come and go, but it's there for anyone to maintain without
silly forking or such. I'm also personally committing a LOT right now to
clean it up. :-)

[Robert Schetterer]

Post by Ralf Hildebrandt

Post by Marco
I hope Amavis could still be maintained. DSPAM is already gone. If also
Amavis dies, Spamassassin will follow...

Especially since Mark is/was active in both amavisd and SpamAssassin!

spamassassin has just released new version 3.4.2 so for now there is no
"big" problem


Best Regards
MfG Robert Schetterer

[pgndev]

The discussed 'facts' here include:

amavisd is not actively maintained
it's a 1-persoon project, & the author's non-responsive to comms
it's perl
spam admin's a constantly moving target

Alternatives do exist, but need to be cobbled together.

In postfix-land, here, a combo of lighter-weight, separable milters using

opendkim
clamav-milter + clamav
spampd + spamassassin
milter-regex
opendmarc
openarc
policyd-spf (not a milter ...)

covers most of the functionality.

then again, _some_ of those^ are not particularly actively
maintained/communicative either.

for me, amavisd -- as-is -- is not a good, future-proof production risk.
the question already posed remains: what, if anything, is?

Glad to see this long overdue discussion being had!

[Christian Rößner]

Post by pgndev
amavisd is not actively maintained
it's a 1-persoon project, & the author's non-responsive to comms
it's perl
spam admin's a constantly moving target
Alternatives do exist, but need to be cobbled together.

Maybe people should have a look at Rspamd ;-)

Just my opinion.

Christian

(Proxy-maintainer for the Gentoo build of Rspamd)

[Ralf Kirmis]

On Wed, 10 Oct 2018 10:45:29 +0530

Post by Christian Rößner
Maybe people should have a look at Rspamd ;-)
Just my opinion.
Christian
(Proxy-maintainer for the Gentoo build of Rspamd)

--
Yes would do that:

if Rspamd would support mysql or another database for the user prefs

and

if Rspamd would support a quarantane feature

My point of view

Ralf

[Christian Rößner]

https://github.com/sys4/rspamd-quarantine
--
Rößner-Network-Solutions
Karl-Bröger-Str. 10, 36304 Alsfeld
T: [phone], F: [phone], M: [phone]
USt-IdNr.: DE225643613, https://roessner-network-solutions.com

Post by Marko Cupać
On Wed, 10 Oct 2018 10:45:29 +0530

Post by Christian Rößner
Maybe people should have a look at Rspamd ;-)
Just my opinion.
Christian
(Proxy-maintainer for the Gentoo build of Rspamd)

--
if Rspamd would support mysql or another database for the user prefs
and
if Rspamd would support a quarantane feature
My point of view
Ralf

[Benny Pedersen]

Post by Christian Rößner

Post by pgndev
Alternatives do exist, but need to be cobbled together.

Maybe people should have a look at Rspamd ;-)

its well tested on raspberry pi running netbsd

Post by Christian Rößner
Just my opinion.

you are not alone ?

Post by Christian Rößner
(Proxy-maintainer for the Gentoo build of Rspamd)

if perl sooks lets hope rspamd soon will be easy to configure with xml
and sqlite

until then i keep my spamassassin prolem

[Tilman Schmidt]

Post by Christian Rößner

Post by pgndev
amavisd is not actively maintained
it's a 1-persoon project, & the author's non-responsive to comms
it's perl
spam admin's a constantly moving target
Alternatives do exist, but need to be cobbled together.

Maybe people should have a look at Rspamd ;-)

You're late to the show.

Post by Christian Rößner
Date: Tue, 09 Oct 2018 19:46:01 +0200
Subject: ANNOUNCE: Amavis project handed over to new project leaders

[Benny Pedersen]

Post by Marco
I hope Amavis could still be maintained. DSPAM is already gone. If
also Amavis dies, Spamassassin will follow...

and spampd, mimedefang, canit, canit-pro, procmail, fuglu

will possible die aswell then ? :=)

note rspamd can be used in amavisd aswell as dspam, amavisd is a
framework like mimedefang and fuglu, dont know how its with caanit and
canit-pro

others might sheed some lights on that

[Boris Gulay]

Post by Benny Pedersen

Post by Marco
I hope Amavis could still be maintained. DSPAM is already gone. If
also Amavis dies, Spamassassin will follow...

and spampd, mimedefang, canit, canit-pro, procmail, fuglu
will possible die aswell then ? :=)
note rspamd can be used in amavisd aswell as dspam, amavisd is a
framework like mimedefang and fuglu, dont know how its with caanit and
canit-pro
others might sheed some lights on that

That's true. Moreover, rspamd already has three(!) statistical modules:
bayes (that can be configured per-user), fuzzy (that works like a
network collecting statistics from many servers that allowed it) and
neural (based on neural networks algorithms). You can choose and enable
any of them or add your own i.e. based on dspam.

[Matus UHLAR - fantomas]

Post by Boris Gulay

Post by Benny Pedersen

Post by Marco
I hope Amavis could still be maintained. DSPAM is already gone. If
also Amavis dies, Spamassassin will follow...

and spampd, mimedefang, canit, canit-pro, procmail, fuglu
will possible die aswell then ? :=)
note rspamd can be used in amavisd aswell as dspam, amavisd is a
framework like mimedefang and fuglu, dont know how its with caanit and
canit-pro
others might sheed some lights on that

That's true. Moreover, rspamd already has three(!) statistical
modules: bayes (that can be configured per-user), fuzzy (that works
like a network collecting statistics from many servers that allowed
it) and neural (based on neural networks algorithms). You can choose
and enable any of them or add your own i.e. based on dspam.

funny to mention, since dspam is dead since 2014 :-)

(would be longer even if new amavisd wasn't released yesterday)

[Indunil Jayasooriya]

Post by Marco
I hope Amavis could still be maintained. DSPAM is already gone. If
also Amavis dies, Spamassassin will follow...

on October 9, 2018, amavisd-new-2.11.1 was released

https://amavis.org/release-notes.txt

[Marko Cupać]

On Wed, 10 Oct 2018 10:45:29 +0530

Post by Indunil Jayasooriya
on October 9, 2018, amavisd-new-2.11.1 was released
https://amavis.org/release-notes.txt

Hallelujah, somebody mentioned this, thank you Indunil.

Bunch of people not reporting bugs, much less sending patches, whining
about vaguely described problems with free (both beer and speech-wise),
highly functional software because it doesn't bump its major release
versions on weekly basis for no reason.

Just today I read two Mark's insightful recent replies on freebsd-ports
mailing list:

Better switch to redis from bdb:
https://marc.info/?l=freebsd-ports&m=153877926022501&w=4

DKIM patch which didn't make it into latest release:
https://marc.info/?l=freebsd-ports&m=153938473800355&w=4

Sometimes answer doesn't come because the asked one cares about limited
time being used optimally.

[Ralf Hildebrandt]

Post by Boris Gulay
Looks like it was long ago. rspamd can now also be installed as a filter
and it works "out of the box".

Yes, it has improved a lot during the last year (or at least since I
last tried installing it).

Post by Boris Gulay
And one more impotent advantage of rspamd: it gives you access to global
SPAM databases like fuzzy and so on. Just take a look at default config
files. It improves spam detection of freshly installed system.

rspamd is designed with mutliple servers in mind (shared databases for
everything, lots of fallback options in case one server goes down etc.)