Made Slashdot:
http://slashdot.org/
A New Type Of Realtime Blocklist: The SURBL
Posted by timothy on Monday April 12, @05:02PM
from the chicken-egg-spam dept.
Glamdrlng writes "The SURBL, or "Spam URI Realtime Blocklist",
represents a nexus of RBL's and content filtering that may bring
us one step closer to a spam magic bullet. While traditional
RBL's perform a DNS lookup on the connecting mail server, SURBL's
take this a step further by parsing the text of the email looking
for URI's and doing a lookup on those web servers. They also
prevent "joe jobs" by maintaining a whitelist of legitimate web
servers whose domain names may show up in spam messages, e.g.
EBay, Paypal, Microsoft, etc. The only requirement to implement
the SURBL is a plugin on your MTA such as spamassassin that can
parse the body of each email. While there is no MTA that directly
supports SURBL's without a plugin, the author hints at one being
in development."
http://yro.slashdot.org/yro/04/04/12/1956252.shtml?tid=111&tid=126&tid=95
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
It may be worth mentioning that I fixed my typo in the text
record. Or not. ;-)
> On Sunday, April 11, 2004, 6:32:49 AM, William Stearns wrote:
>> On Sun, 11 Apr 2004, Jeff Chan wrote:
>>> "Message body contains domain in sa-backlist. See: http://www.stearns.org/sa-blacklist/"
>
>> Looks good, except sa-backlist needs another "l". *smile*
>
> Indeed it does. Fixed. Thanks! LOL!
It now reads:
"Message body contains domain in sa-blacklist. See: http://www.stearns.org/sa-blacklist/"
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Hi All, and Welcome to the folks who recently joined!
Looks like the list archive links need a slight fix.
Currently the URLs have the host as "localhost.localdomain"
where that should be "lists.surbl.org" instead. Let me ask
Raymond to please update that config in Mailman. :-) In the
meantime all the list archives can be found at:
http://lists.surbl.org/pipermail/announce/http://lists.surbl.org/pipermail/discuss/http://lists.surbl.org/pipermail/zones/
Of perhaps special interest, please see and comment on
the proposal on the discussion list for the second revision of
the sc.surbl.org data engine which will resolve spam domains to
IP addresses and prejudice future domain reports based on prior
statistics for those IP addresses. (These IP addresses would
only be used internally and the resulting hopefully-improved RBL
data would still be domain-based. It does not represent a shift
to a numbered RBL *for URI checking*, which I feel is a suboptimal
approach.) I think this could be a very effective way to catch
spam operations and spam ISPs with simply more intelligent use of
the existing SpamCop URI domain data. That thread starts at:
http://lists.surbl.org/pipermail/discuss/2004-April/000002.html
Frankly I think it's going to rock and would like your comments
on it.
Cheers,
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
I've udpated the TXT message for the sa list, addding a URI:
"Message body contains domain in sa-backlist."
to:
"Message body contains domain in sa-backlist. See: http://www.stearns.org/sa-blacklist/"
This makes for a slightly larger BIND zonefile, but it's perhaps
more descriptive. Comments please to discuss(a)lists.surbl.org .
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
FWIW I've changed all three lists to send out only plain text.
I have no idea if that's standard practice in Mailman, but like
most, ahem, experienced Internet users I prefer my mail messages
as plaintext. And it was a simple change of the top default
content setting, so I assume it's the most common switch used
(after ~not filtered).
Specifically Mailman will filter out any attachments that are
not multipart/mixed, multipart/alternative, or text/plain,
and convert any resulting text/html messages to plain text.
Messages that have not recursively resolvable plain text are
rejected back to the sender with an explanation, if I'm reading
the Mailman description correctly.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
[re-sending on the more appropriate list]
FWIW I just registered surbl.net and surbl.com to prevent
doofuses from registering them and setting up bogus RBLs on
them, as I recall happened to another RBL.
Also set up an Apache redirect permanent for them to
www.surbl.org, which remains the real domain and site.
Cheers,
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/