Discuss December 2004

discuss@lists.surbl.org

43 participants
80 discussions

RE: [SURBL-Discuss] RE: Feature Request: Whitelist_DNSRBL
by Chris Santerre 08 Dec '04

08 Dec '04

>-----Original Message----- >From: Alex Broens [mailto:surbl@alexb.ch] >Sent: Wednesday, December 08, 2004 12:34 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] RE: Feature Request: Whitelist_DNSRBL > > >Chris Santerre wrote: >> Well we have talked about it and .... didn't come up with a >solid answer. >> The idea would cause more lookups and time for those who >don't cache dns. We >> do have a whitelist that our private research tools do poll. >The idea is >> that if it isn't in SURBL then it is white. >> >> This also puts more work to the already overworked contributors. ;) > >want to put me on the round robin list again? Yes I would, but I think it is broke. We have been trying to get one person off, but haven't been able to. Security issue. I'll let Dallas chime in on this one. --Chris

1 0

Re: Feature Request: Whitelist_DNSRBL
by Bill Landry 08 Dec '04

08 Dec '04

----- Original Message ----- From: "David Hooton" <david.hooton(a)gmail.com> > On Wed, 8 Dec 2004 08:03:35 -0800, Bill Landry <billl(a)pointshare.com> wrote: > > I agree, and have suggested a whitelist SURBL several times on the SURBL > > discussion list, but it has always fallen on deaf ears - nary a response. > > It would be nice if someone would at least respond as to why this is not a > > reasonable suggestion. > > The floor in offering a DNS based whitelist is that it encourages > people to place a negative score on it. The problem with this is that > spammers can poison messages with whitelisted domains, thereby > bypassing the power of the SURBL I agree, it should not be used as a HAM indicator, way too easy to abuse. I was suggesting that the whitelist be used as a way to exclude the domain from being constantly queried against the SURBL name servers. > The concept of "Whitelist" in the SURBL world is more of an "Exclusion > List" as in "we exclude these domains from being listed" rather than > we consider the presence of these domains in an email to be a good > sign of ham. Exactly. > An excluded domain is therefore ignored in all data and not allocated > a score positively or negatively, so trying to poison a message with > whitelisted domains is therefore pointless. Yep, agree wholeheartedly. > I think we either need to look at a DNS version of > uridnsbl_skip_domain with long TTL's or we should look at releasing a > .cf file. I personally think the more proper implementation may be > the DNS based version in order to avoid BigEvil type situations. Indeed, my thoughts exactly. Bill

1 0

RE: [SURBL-Discuss] Feature Request: Whitelist_DNSRBL
by Chris Santerre 08 Dec '04

08 Dec '04

>> Thoughts, suggestions, or coffee? > >First, where's that coffee? In my belly! >then: I keep a .cf file with a quite a few lines like. > >uridnsbl_skip_domain ibill.com blabla.tld local-boobie-site.dom Doh! It helps to RTFM I guess :) LOL at boobie-site! Seeing as this feature is in place and I'm just thickheaded, I'll talk with Jeff about creating a cf file, or the 127.0.0.0 issue. But I'm leaning towards the cf file for now. Stay tuned..... --Chris (Ooh baby do you know what that's worth, oooh heaven is a place on earth!)

1 0

RE: Feature Request: Whitelist_DNSRBL
by Chris Santerre 08 Dec '04

08 Dec '04

> >>Thinking one step bigger, it would be even better to feed >this a file. This >>way maybe SURBL can create a file for the top hit legit >domains. Then using >>SARE and RDJ, people could update that. This would reduce a >lot of traffic >>and time. > >Wait, now you're bringing SURBL into this.. are you talking >normal DNSRBLS, >or URIDNSBLS? Or both? Dang my brain!!! I meant URIDNSBLS!! Freaking too many abreviations in my head :) > >Was the whitelist you were referring to really the SURBL >server-side whitelist? Yes! But local SURBL whitelists are needed to reduce traffic and time. > >>This might also help with the mysterious bug we have seen >where some local >>domains are being flagged as SURBL hit, when they aren't in >SURBL. Perhaps >>whitelisting local domains so they are skipped would do away >with this. > >Agreed.. It would provide users a short-term fix, although really the >problem does need to be rooted out at some point.. > >>Thoughts, suggestions, or coffee? > >All of the above? Pouring a cup right NOW! --Chris

1 0

Re: Feature Request: Whitelist_DNSRBL
by Matt Kettler 08 Dec '04

08 Dec '04

At 10:17 AM 12/8/2004 -0500, Chris Santerre wrote: >OK, we know that the popular domains like yahoo.com and such are hard coded >into SA to be skipped on DNSRBL lookups. But it would be great to have a >function to add more locally. Um. They are?? AFAIK there are absolutely no whitelists to the DNSRBLs in SA itself. Don't confuse the "EXISTING_DOMAINS" list in DNS.pm with a whitelist. That's actually a list of domains that are used to test if your DNS is working if you don't have dns_available set to yes. SA does a quick MX query for one of the domains in the list, and if it gets an answer, it knows it's working... However, I do agree it would be nice to be able to have a DNSBL whitelist capability, if for no other reason than fixing any listings that might cause short-term FPs. >Thinking one step bigger, it would be even better to feed this a file. This >way maybe SURBL can create a file for the top hit legit domains. Then using >SARE and RDJ, people could update that. This would reduce a lot of traffic >and time. Wait, now you're bringing SURBL into this.. are you talking normal DNSRBLS, or URIDNSBLS? Or both? Was the whitelist you were referring to really the SURBL server-side whitelist? >This might also help with the mysterious bug we have seen where some local >domains are being flagged as SURBL hit, when they aren't in SURBL. Perhaps >whitelisting local domains so they are skipped would do away with this. Agreed.. It would provide users a short-term fix, although really the problem does need to be rooted out at some point.. >Thoughts, suggestions, or coffee? All of the above?

1 0

UGH.. More false positives
by Matt 08 Dec '04

08 Dec '04

I've got some more false positives.. this one appears to be my.yahoo.com !!! From: "Mark Roberts" <maxmedianews(a)yahoo.com> To: "WGRC" <news(a)wgrc.com> Sent: Tuesday, December 07, 2004 5:48 AM Subject: [SPAM] 12/7 > Spam detection software, running on the system "spamcobra.swift-networks.com", has > identified this incoming email as possible spam. The original message > has been attached to this so you can view it (if it isn't spam) or block > similar future email. If you have any questions, see > the administrator of that system for details. > > Content preview: M.Roberts 12/7/04 News [...] > > Content analysis details: (5.5 points, 5.0 required) > > pts rule name description > ---- ---------------------- ---------------------------------------------- ---- > 0.0 HTML_MESSAGE BODY: HTML included in message > 0.5 HTML_20_30 BODY: Message is 20% to 30% HTML > 5.0 SPAMCOP_URI_RBL URI's domain appears in SpamCop data at http://www.surbl.org/lists.html > [my.yahoo.com is blacklisted in URI RBL at] > [sc.surbl.org] > > The original message was not completely plain text, and may be unsafe to > open with some email clients; in particular, it may contain a virus, > or confirm that your address can receive spam. If you wish to view > it, it may be safer to save it to a file and open it with an editor. > > Subject: 12/7 From: Mark Roberts <maxmedianews(a)yahoo.com> Date: Tue, 7 Dec 2004 02:48:31 -0800 (PST) To: WGRC <news(a)wgrc.com> M.Roberts 12/7/04 News (Northumberland County)---A car and an oil-delivery truck crashed head-on yesterday afternoon in Northumberland County, killing a young Luzerne County woman. Northumberland County Coroner James Kelley identified the victim as 22-year-old Ann Marie Piasecki of Wilkes Barre. Route 487 was closed after the truck and car crashed about 1:30 p-m near the Fleetwood Motor Homes plant near Elysburg. A passenger in Piasecki's car was flown to Geisinger. Police continue to investigate yesterday's fatal Northumberland County Crash. (Montour County)---Plea negotiations are under way in the case of an Amish farmer accused of sexually assaulting several young girls at or around his farm in northern Montour County. The press enterprise says 47 year old Eli Hostetler, of Anthony Township, was granted a trial continuance at the request of defense attorney. Hostetler faces a host of charges including rape, corruption and child endangerment filed by state police at Milton. Some of the allegations made against him date back more than 11 years. (State)---When the Electoral College meets next week, 21 of Pennsylvania's staunchest Democrats will cast their electoral votes for defeated presidential nominee John Kerry. The state's electors will gather in the state House chamber December 13th, the day the 538 members of the Electoral College nationally cast ballots confirming President Bush's victory. (Drugs)---New research suggests that top-selling pain reliever Celebrex does not carry the same heart attack risk as Vioxx, a similar drug pulled from the market in September because of safety concerns. A study by University of Pennsylvania researchers is the first to compare the two arthritis drugs since the recall. (Columbia County)--- The new owner of the Columbia Mall in Buckhorn is promising more stores and a movie theater. Bayview Financial of Florida will take over the mall next month from Columbia Mall Associates. The current owners say the mall has lost nearly 20 (m) million dollars in value since 1995. (Luzerne County)--- The city of Wilkes-Barre has agreed to pay 225-thousand dollars for a former bank building in a prominent downtown location. The building that once housed the First National Bank has been vacant since the flood of 1972. City Leaders are looking at the idea of restoring it. (Northumberland County)---Three people were injured after a crash yesterday morning at route 54 and 44 in the boro of Turbotville, Northumberland County. State Troopers say the crash occurred as 77 year old Annabelle Temple of Milton was attempting to cross 54 when she pulled into the path of 67 year old Sylvia Lawrence of Riverside. Both Lawrence and Temple were transported to Geisinger for treatment. A 2 year old passenger with Temple also suffered minor injuries and was taken to the Evangelical Hospital for treatment after yesterday's crash in Northumberland County. (Perry County)---State Troopers are looking into a Burglary which occurred sometime yesterday afternoon at the Millerstown Town Moose in Greenwood Township, Perry County. Officers explain, suspects entered the building and removed an undetermined amount of money, before fleeing thru a side door. Anyone with information into that robbery yesterday afternoon at the Millerstown moose should contact authorities. (Flu)---More flu vaccine is on the way. The government plans today to announce the purchase some of the five million doses available from plants in Canada and Germany. The Food and Drug Administration has signed off on the safety of a portion of the supply after doing inspections and tests. (Pearl Harbor)---Today marks the 63rd anniversary of the attack on Pearl Harbor. Survivors are returning to the Hawaii site to honor the more than two-thousand soldiers who died in the Japanese surprise attack. (Bloomsburg)--- Bloomsburg has plans to draw up a budget for next year that would reduce property taxes by almost 6.7 percent, but would hike a tax on in-town workers from $10 to more than $35. Today's press enterprise reports the idea was brought up at a workshop meeting last night. The state Legislature recently passed a law allowing municipalities to raise the old occupational assessment tax from $10 up to $52. Bloomsburg Councilmen entered the night looking at a roughly $309,000 budget deficit for next year. (Montour County)---Montour County might lay off a few employees and raise taxes next year to balance its 2005 budget. According to the press enterprise, Montour County is allowed to raise property taxes by only 10 percent, which would mean about $20 more in property tax for the typical resident. Commissioners would not reveal any specific figures from the 2005 budget. They said they will release the tentative budget and new tax rates at their meeting on Thursday. (Dog License)---Don't forget to get lucky or rover his tags….2005 dog licenses go on sale this week. Licenses are required for all dogs more than three months old. If the animal is spayed or neutered, the license is $6. If they are not, the license is $8. In 2004, county treasurers and state agents sold licenses for more than 900,000 dogs. Do you Yahoo!? Meet the all-new My Yahoo! – Try it today!

4 9

a few URL blacklist sources
by Daniel Quinlan 07 Dec '04

07 Dec '04

A great source you probably already know about, Wiki URL blacklists, especially the ones edited on a Wiki: http://moinmaster.wikiwikiweb.de/BadContent http://www.emacswiki.org/cgi-bin/wiki?BannedContent Not quite sure how these are edited: http://spammers.chongqed.org/ or http://blacklist.chongqed.org/ http://www.jayallen.org/blacklist.txt Open source web proxy filter ... maybe willing to share their URL lists? Of course, this is not a spammer list as far as I know, but perhaps it can be used to amplify and verify SURBL whitelist (to eliminate things) or blacklists (to cross-check an addition). http://www.censornet.com/ Huge list of URL blacklists: http://spamlinks.openrbl.org/filter-bl.htm Worth trying something more elaborate? Provide the Wiki folks with a better infrastructure for banning URLs used in Wiki spam (which I'm fairly confident will correlate well with email spam). 1. Get multiple wikis to use a standard format for bad content lists, feed into a SURBL-based Wiki blacklist. 2. All SURBL blacklists can be used on supporting Wikis. So, SURBL gets a new blacklist (the best kind, one fed with a different type of source), Wikis get a much wider blacklist, etc. Daniel -- Daniel Quinlan http://www.pathname.com/~quinlan/

2 3

RE: [SURBL-Discuss] Re: a few URL blacklist sources
by Chris Santerre 07 Dec '04

07 Dec '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, December 07, 2004 1:13 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] Re: a few URL blacklist sources > >> http://www.emacswiki.org/cgi-bin/wiki?BannedContent > >> http://spammers.chongqed.org/ or http://blacklist.chongqed.org/ >> http://www.censornet.com/ > >> http://spamlinks.openrbl.org/filter-bl.htm >With theese in mind, would anyone like to help us research some >of these other possible sources that Daniel brings up? Multiple >opinions could be useful. > *snipped stagnant from above* I will research: >> http://spammers.chongqed.org/ or http://blacklist.chongqed.org/ Any takers on the others? --Chris

1 0

RE: [SURBL-Discuss] Hi I'm new and I like SURBL
by Paul Schwarz 07 Dec '04

07 Dec '04

In our scenario sbl-xbl at the MTA plus SURBL blocks 80% of spam... If I add greylisting the result goes up to over 95%. I use Xwall spam filter. I wish all SMTP servers were greylisting compliant - there are some interesting problems - bummer. Is anyone else recommending or not recommending greylisting and what are your experiences. Seems like surbl should get more effective over the years but right now it probably only stops 50% of our spam if used by itself. Paul Schwarz Stark Truss Company, Inc. Senior Network Administrator (330) 478-2100 -----Original Message----- From: Jeff Chan [mailto:jeffc@surbl.org] Sent: Wednesday, December 01, 2004 4:14 AM To: Paul Schwarz Cc: 'SURBL Discussion list' Subject: Re: [SURBL-Discuss] Hi I'm new and I like SURBL On Tuesday, November 30, 2004, 6:02:53 AM, Paul Schwarz wrote: > sbl-xbl.spamhaus.org - reject at SMTP level standard greylisting > SURBL - using multi.surbl.org Hi Paul, sbl-xbl at the MTA plus SURBL use should be an effective combination. It's what I've been recommending to other folks. Preventing spams from even entering your network using spamhaus is quite safe, fast and smart. Jeff C. -- "If it appears in hams, then don't list it."

5 4

RE: [SURBL-Discuss] www.rulesemporium.com down?
by Paul Schwarz 07 Dec '04

07 Dec '04

Seems up now. Paul Schwarz -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Thomas Kinghorn [MTNNS -Rosebank] Sent: Tuesday, December 07, 2004 4:36 AM To: SURBL Discussion list Subject: RE: [SURBL-Discuss] www.rulesemporium.com down? Same result. Looks down. Tom -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Martin Sent: 07 December 2004 11:29 AM To: discuss(a)lists.surbl.org Subject: [SURBL-Discuss] www.rulesemporium.com down? Or is it just here? Thanks / Martin _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss December 2004