Discuss June 2004

discuss@lists.surbl.org

44 participants
88 discussions

RE: [SURBL-Discuss] The beast has been fed. 6dos now in WS.surbl. org
by Chris Santerre 29 Jun '04

29 Jun '04

Agreed. But I still think you should leave the updated version up ;) Here is what I added: http://www.merchantsoverseas.com/domains-1.tar.gz link good until 2 PM tomorrow. >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, June 28, 2004 7:35 PM >To: SURBL Discussion list (E-mail) >Subject: Re: [SURBL-Discuss] The beast has been fed. 6dos now in >WS.surbl.org > > >I spoke with Bill Stearns and Chris Santerre separately by >phone, and what we came up with is to put the 6dos data into a >new, separate list, reflecting that it's a larger data source >with a different philosophy behind it. It tends to be more >inclusive than some of the other lists, meaning it may have >greater potential for false positives. And at about 80,000 >entries, it's clearly a larger list then our others, which >currently max out at about 20,000 for ob and ws (natively). >The 80,000 records in 6dos probably have *not* been hand-checked. > >Chris expressed that he's becoming more comfortable using 6dos >since the author has been adding some more cross-checking of the >data, but we all agreed the data may be better in a separate >list. Maybe I'll call it 6d or 6dos.surbl.org. > >By the way Bill's server is being worked on right now, so >we don't have the ability to update ws to disable the 6dos >inclusion. Chris will do that when he's able to next. > >Until then I've reverted ws.surbl.org to an older version of >the list that I had from three days ago. That should be >reasonably close to the pre-6dos version that was being >served before. > >Jeff C. > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

2 1

The beast has been fed. 6dos now in WS.surbl.org
by Chris Santerre 29 Jun '04

29 Jun '04

The '6dos' project domains have now been fed into ws.surbl.org. This is a huge collection of spam domains. The reason I did this now is the format is changing and it would have been a nightmare to do this later. I briefly looked thru them, but there are a LOT. I expect a few FPs. But for the shear number of domains you can't beat it. I will remove any reported FPs. Bill if you want to whitelist some if I can't get to them right away, go ahead. I will post when I remove, or if they are spammers and the whitelist needs to be removed. This is a great addition. And NO I can't tell you the source of the '6dos' project. You will just have to contact me with any questions :) So the beast has been fed a proper dinner. Be ready for a few burps! Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

2 3

ws / be / bigevil.cf
by Mariano Absatz 29 Jun '04

29 Jun '04

Hi, according to http://www.surbl.org/lists.html#be be.surbl.org is deprecated and ws.surbl.org has the data from bigevil.cf. Does that mean that if I use 'ws.surbl.org' I can stop using bigevil.cf altogether? Or are there reasons to keep using bigevil.cf even when I use ws.surbl.org? Regards. -- Mariano Absatz El Baby ---------------------------------------------------------- When I was kidnapped, my parents snapped into action. They rented out my room. -- Woody Allen

2 1

RE: [SURBL-Discuss] Re: [SARE] Bigevil IMPORTANT update/test.
by Chris Santerre 28 Jun '04

28 Jun '04

I will be coming out with a wildcard BE. But not for a while. I have to finish a ton of stuff. DOn't worry, I'm sure there will be a grand announcment. ;) --Chris >-----Original Message----- >From: Andy Jezierski [mailto:ajezierski@stepan.com] >Sent: Friday, June 25, 2004 12:30 PM >To: Chris Santerre >Cc: SURBL Discussion list (E-mail); Spamassassin-Talk (E-mail) >Subject: [SURBL-Discuss] Re: [SARE] Bigevil IMPORTANT update/test. > > > > > > >Chris Santerre <csanterre(a)MerchantsOverseas.com> wrote on 06/25/2004 >11:21:20 AM: > >> I have no idea how this will effect systems under heavy load. Those >systems >> should definitely stay with SURBL as this is just a local >regex copy of >it. >> But for those systems that can't/won't use SURBL and want a >local copy of >> this larger bigevil here is the link: (~600k) >> > >Will you be coming up with a MiniEvil that contains just the wildcard >rules? Or have all the wildcard sites been added to surbl >individually? > >Andy > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

RE: [SURBL-Discuss] ob and ab added to multi.surbl.org, docs upda ted for multi use
by Chris Santerre 28 Jun '04

28 Jun '04

>Nah. go ahead and announce! other products will want to use >it, no need for them to wait for SpamAssassin. ;) OUCH, thats not funny! ;) --Chris

1 0

RE: [SARE] Bigevil IMPORTANT update/test.
by Chris Santerre 28 Jun '04

28 Jun '04

Yes this is exactly what will be happening. There will be a dynamic only bigevil. Not only looking for domain names. But things like directory names in a recent spam campaign, or anything else in common with a recent spam storm. No time set yet for this to happen. But it will be a whole different ruleset. I need to finish the set I'm working on now. --Chris >-----Original Message----- >From: Jesse Regier [mailto:jregier@accesshub.com] >Sent: Friday, June 25, 2004 6:13 PM >To: Spamassassin-Talk (E-mail); SURBL Discussion list (E-mail) >Subject: Re: [SARE] Bigevil IMPORTANT update/test. > > >Wouldn't it make sense to create two new lists > >BIGBIGEVIL: generated from the surbl list >WILDLYEVIL: Wildcard only domains > >and keep BIGEVIL the way it is for a few months or so? > >I am currently using ws.surbl.org and the current BIGEVIL list >via rules_du_jour on several servers. (I wanted to keep the >wildcard domains.) >If a lot of people are doing this they could be taken by >surprise when the >BIGEVIL list suddelnly gets bigger. > >Hey, thanks to you and all the ninjas, for all the good work!! > >Jesse > >On 25 Jun 2004 at 12:21, Chris Santerre wrote: >> >> The only updates I've been doing to the regular BE is >removing a few FPs. I >> will not officially make this new large file the regular >Bigevil for at >> least a week. > >-------------------------------------------------- >Jesse Regier >Computer Systems, Inc. >(402) 330-3600 >-------------------------------------------------- > >

1 0

Re: [SARE] Bigevil IMPORTANT update/test.
by John Wilcock 28 Jun '04

28 Jun '04

On Fri, 25 Jun 2004 17:13:03 -0500, Jesse Regier wrote: > BIGBIGEVIL: generated from the surbl list > WILDLYEVIL: Wildcard only domains > > and keep BIGEVIL the way it is for a few months or so? > > I am currently using ws.surbl.org and the current BIGEVIL list > via rules_du_jour on several servers. (I wanted to keep the wildcard domains.) > If a lot of people are doing this they could be taken by surprise when the > BIGEVIL list suddelnly gets bigger. Seconded. I don't use bigevil directly myself any more but I can see people having a huge evil surprise, particularly if the proposed change were to happen during the summer with many admins away on holiday leaving their boxes in the hands of often less experienced backups. John. -- -- Over 2400 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr

1 0

RE: [SURBL-Discuss] Please test ob, ob2, ab
by Joseph Burford 28 Jun '04

28 Jun '04

> > ob2.surbl.org > > Please beta test it against ob.surbl.org Jeff, Data from my test box is below, hope this helps. 25/06/2004 - 3,756 messages 1,816 marked as spam Description Total Ham % Spam % URL in ws.surbl.org 802 9 1.1 793 98.9 URL in ob.surbl.org 711 10 1.4 701 98.6 URL in sc.surbl.org 621 1 0.2 620 99.8 URL in ob2.surbl.org 617 1 0.2 616 99.8 URL in ab.surbl.org 377 6 1.6 371 98.4 URL in be.surbl.org 44 0 0 44 100 26/06/2004 - 2,362 messages 1,566 marked as spam Description Total Ham % Spam % URL in ob.surbl.org 678 1 0.1 677 99.9 URL in sc.surbl.org 626 0 0 626 100 URL in ob2.surbl.org 624 0 0 624 100 URL in ws.surbl.org 576 1 0.2 575 99.8 URL in ab.surbl.org 415 17 4.1 398 95.9 URL in be.surbl.org 70 0 0 70 100 27/06/2004 - 1,956 messages 1,313 marked as spam Description Total Ham % Spam % URL in sc.surbl.org 625 0 0 625 100 URL in ws.surbl.org 622 2 0.3 620 99.7 URL in ob.surbl.org 590 0 0 590 100 URL in ob2.surbl.org 590 0 0 590 100 URL in ab.surbl.org 423 0 0 423 100 URL in be.surbl.org 32 0 0 32 100 Regards, Joseph

2 1

Multiple URIs
by David Coulson 27 Jun '04

27 Jun '04

I sent myself an e-mail with two URIs, two different domains, which are in a number of surbl lists (sc, ws and ob specificly). However, only the first domain was actually 'caught' and included in the spam filter report in SA (2.63). Shouldn't each specific domain which is included in a SURBL be used to establish a score? I know it's unusual for a spam to include a URI for two different domains, but shouldn't it increase the score anyway? David

4 4

[SURBL-Discuss] ob and ab added to multi.surbl.org, docs updated for multi use
by Jeff Chan 27 Jun '04

27 Jun '04

We've added the content from ab and ob into multi.surbl.org, so it now has all the currently active lists: http://www.surbl.org/lists.html with the following bitmasks representing the different lists: 2 = comes from sc.surbl.org 4 = comes from ws.surbl.org (and be.surbl.org) 8 = comes from phishing list (labelled as ph in multi) 16 = comes from ob.surbl.org 32 = comes from ab.surbl.org I've also updated the SURBL Quick Start page: http://www.surbl.org/quickstart.html to link to the updated URIDNSBL.pm page containing the urirhssub program which can use multi.surbl.org: http://spamassassin.org/full/3.0.x/dist/lib/Mail/SpamAssassin/Plugin/URIDNS… and also added sample configs for using multi.surbl.org based on the sample URIBL configs at: http://www.spamassassin.org/full/3.0.x/dist/rules/25_uribl.cf Would someone who has actually used urirhssub please check the sample configs and scores for correctness? Updating the documentation like this is in preparation for the release of SA 3.0. Does anyone have any thoughts on when we should announce the multi.surbl.org support? Should it wait until 3.0 is fully released or not? Jeff C.

2 2

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss June 2004