Sophos Firewall: v19.0 MR1: Feedback and experiences

Hi,

I received an email about 10 minutes ago, it has a number of attachments which are all blank, further the email does not show in logviewer -> email. There a e two entries at the time of the email with no details and show possible spam.

Ian

Further to the message above, I sent the originator a question about the attachment and he advised other recipient were able to view it. I took the iPhone out of the wifi and was able to see the attachment which is an mp4 file.. So something is broken in the latest mail functions in v19.0.1.

I have not made any changes to my mail settings, least of all have the ability to hide messages from XG log viewer -> email report. I have received other messages which do not show up in log viewer. This is an issue that was fixed a couple of versions ago.

Ian

Ian

LuCar Toni please look at good SASI engine and tell me if this for you look like marketing email or SPAM email? For me and all our users this are SPAM or PHISHING emails:

With 18.5 MR2 we don't get emails like this.

We use "Standard RBL Services", "Premium RBL Services" and additional RBL lists but do not help.

We use Spamhouse:

• zen.spamhaus.org
• sbl.spamhaus.org
• pbl.spamhaus.org
• xbl.spamhaus.org

And Baracudacentral:

b.barracudacentral.org

Some mails have unsubscribe options, others don't. Sure, I can ask if they are willing to unsubscribe from everything where it is possible, but be prepared that they will complain about unsubscribing from dozens of mailing lists that were never subscribed in the first place. An option to set the level of aggression used by the spam engine would be of more help I guess.

Some customers had other spam solutions in use before we switched them to Sophos. All was fine, then you guys changed the engine (again: nobody asked for this!) and now we, as your partner, have to deal with customer complaints about how much better everything was "before we switched to Sophos", thank you, really.

To circle back on this: A vendor will likely use there own engine, if possible. After looking at the recent years, i could not spot a problem in any sense to perform such a change. 

Dreamcatcher feel free to discuss this in more detail with your sales rep. I am quite sure, we can do something like a migration to Central Email for your customers. 

About your feedback DejanBukovec I cannot understand nor say anything about your examples due the fact i cannot understand this language. You should highlight those examples to Labs, they can give you a proper statement about those emails. 

I already explained this. Central Email is not an option for our customers. We will not offer them the same solution (email protection) from the same company that first took their money and then, without any explanation, degraded the product they had already purchased, just to sell them the same thing for even more. If we have to sell a dedicated product anyway, I see no point in staying with Sophos at all.

I can only highly recommend you to look out the open discussion about the opportunity. I cannot assist anymore than offer the dialog. 

Hi Dreamcatcher

do you have some news to share on the spam detection topic?

No, nothing new. They will investigate the issue and get back to me, but so far they haven't even admitted that there is a problem at all.

I had opened support case about spam, which has been closed yesterday by tehnician with reason inactivity(I send last email response on friday and he close it on monday)... For us case is not closed until engine will not work as before with older engine which has been reason to use and BUY this subscription but Sophos know that better than us.

After upgrade to MR1 AND Sophos Lab actions to include our samples into engine spam detection in last 10 days has been a lot of better. We receive only national(slovenian) spams. but today we start receiving some phishing mails which are not in national language:

Hi Dejan Bukovec, sorry to hear your case was closed prior to resolution. Reviewing the case, the email response you sent on Friday did not come through. Please let me know and I can reopen a case. 

Hi Karlos,

If I resend email without attachments will case be reopened or you need reopen it? Now Im on vacation until 6.9. so maybe reopen it after that...

Thanks.

Best regards, Dejan

Hi Karlos,

If I resend email without attachments will case be reopened or you need reopen it? Now Im on vacation until 6.9. so maybe reopen it after that...

Thanks.

Best regards, Dejan

Yes, I would need to open a new case. Once you are back and ready to pick up, please send me a DM and I will provide you a new case ID.

Best,

Hi Dreamcatcher and Karlos

Have you any news for the poor spam recognition on v18.5 MR3 / v19.0 and versions above?

This is the last answer I got from the support:

"Development has sent a proposal for handling "bulk" messages and change how the spam classification works in the MTA mode. After the proposal is approved by both Product Management and Labs, we schedule this new feature for an MR Release."

They will get back to me this week, so at least there's some hope I guess.

Thanks for your effort and sharing your information!

Hi Dreamcatcher,
did Sophos Support get in touch with you, did you receive any further information?

Yes, to tell me that they need more time. They said they will get back to me this week, but that didn't happen yet.

Hi Dreamcatcher, thanks for your effort. Did you received something new about the case?

Yes, support contacted me yesterday. They asked to get access for 4 weeks to the firewall to check if their current solution is working. Maybe we will see a public release at least this year? We'll see.

Hi Karlos ,

do you have any news on this?

Hey, not really. They asked for more spam samples and are working on a better bulk spam detection, but no ETA or anything.