Discuss September 2004

discuss@lists.surbl.org

62 participants
229 discussions

RE: [SURBL-Discuss] Proposing a greylist
by Chris Santerre 03 Sep '04

03 Sep '04

It has been moved off list. See Ryan's post. If you would like to be involved, contact him. --Chris (wishes this thread to go away now.) >-----Original Message----- >From: Bret Miller [mailto:bret.miller@wcg.org] >Sent: Friday, September 03, 2004 5:00 PM >To: SURBL Discussion list >Subject: RE: [SURBL-Discuss] Proposing a greylist > > >To further this idea, comparing it to DNSBLs is appropriate. >There are a >lot of DSNBLs you can use. Many agree that sbl-xbl spamhaus lists are >high quality with no (or almost no) false positives. For that reason, a >lot of us use them to block e-mail. > >Bl.spamcop.net is another DNSBL, and while it's a fine list, >the FP rate >is much too high for me to block e-mail on it alone. However, it's >highly useful in SpamAssassin, putting many messages over the >spam score >threshold. > >While the SURBL staff has decided that they would rather not "divide >their efforts" to support a project like this, it certainly >doesn't mean >that it shouldn't be done be someone else. At that point, the staff is >right to ask that the discussion about its details be moved off this >list. Perhaps the better place to discuss this is the SA >general list as >they are more open to just about any new project that helps SA detect >spam accurately. > >I know if I relied totally on any one method of filtering >spam, a lot of >spam would be getting through that isn't. It's because the >comination of >content and structure analysis with bayesian analysis DNSBL and URIBL >all contributes to the end result. > >Bret > > > > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

Proposing a greylist
by Chris Santerre 03 Sep '04

03 Sep '04

I am officially proposing a greylist surbl. We are going to see more and more of this stuff. We might as well deal with it now. I'm suggesting a greylist for all spammers that ride that line. Like the euniverse junk we have been talking about. 1)We DO NOT include it in multi. 2)We SCREAM to the world that it WILL hit some legit, and that only hard liners should use. 3)We DON'T remove domains unless they go completely black, or have no NANAS hits for 3-4 months. 4)See number 2 again. 5)We tell people it is completely optional and to see number 2. I predict it would be used more for personal emails. IT also gives us an in between mechanism. Rather then list or no list. We get a grey list we desperately need. THoughts? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

12 31

RE: RE: [SURBL-Discuss] "Unconfirmed" list proof-of-concept
by Chris Santerre 03 Sep '04

03 Sep '04

>-----Original Message----- >From: Rob McEwen [mailto:rob@powerviewsystems.com] >Sent: Friday, September 03, 2004 4:04 PM >To: SURBL Discussion list >Subject: Re: RE: [SURBL-Discuss] "Unconfirmed" list proof-of-concept > > >Chris and Ryan... > >I think that ya'll are making a mistake... please reconsider >the advice I gave in my last two e-mails (did you read them?). > >Basically, you would have gotten just about everything you >ever wanted by following my advice (not the Spamhaus part... >but, rather the tracking part) and it would all then be done >with official SURBL-participation and blessings... (did you >yawn during the SpamHaus part of my message and ignore the >rest?)... of course, this assumes that Jeff will warm up to my >suggestion in the first place?? > >But, if your way is inevitable, I just might join you... just >please reconsider in the meantime... and wait to see what >Jeff's final word is on this matter. > Jeff has given his final word on this. Was pretty clear :) And I respect Jeff's wishes. This really isn't that big of a deal. Its going to be completely private until a good data set is made, then made availible for testing by SURBL members if they want it. Just another list, that won't be attached to the SURBL name. Discussions won't be carried out in the SURBL list. Of course if in normal SURBL traffic we find a domain unfit for blacklisting, we may see fit to add to UC. Otherwise for now it will seem like this discusion never took place :) --Chris (You saw nothing.)

1 0

RE: [SURBL-Discuss] "Unconfirmed" list proof-of-concept
by Chris Santerre 03 Sep '04

03 Sep '04

LOL yeah I already sent him an email saying to let us know when it is back up. I'm sure he is ready for an ice cold brew! --Chris (Top posting for fun and profit!) >-----Original Message----- >From: Alex Broens [mailto:surbl@alexb.ch] >Sent: Friday, September 03, 2004 4:03 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] "Unconfirmed" list proof-of-concept > > >Chris Santerre wrote: >> Look mom! I have another project! :) >> >> I think I'll start an Apache project that attempts to >combine other Apache >> projects! Woot! > >and here's another: You tell me what to do with all those nice >ZeroHour >URIS I'm collecting while poor Bill is sweating? > >Fosters time... > >Alex >

1 0

Re: RE: [SURBL-Discuss] "Unconfirmed" list proof-of-concept
by Rob McEwen 03 Sep '04

03 Sep '04

Chris and Ryan... I think that ya'll are making a mistake... please reconsider the advice I gave in my last two e-mails (did you read them?). Basically, you would have gotten just about everything you ever wanted by following my advice (not the Spamhaus part... but, rather the tracking part) and it would all then be done with official SURBL-participation and blessings... (did you yawn during the SpamHaus part of my message and ignore the rest?)... of course, this assumes that Jeff will warm up to my suggestion in the first place?? But, if your way is inevitable, I just might join you... just please reconsider in the meantime... and wait to see what Jeff's final word is on this matter. Rob McEwen

1 0

RE: [SURBL-Discuss] "Unconfirmed" list proof-of-concept
by Chris Santerre 03 Sep '04

03 Sep '04

>-----Original Message----- >From: Ryan Thompson [mailto:ryan@sasknow.com] >Sent: Friday, September 03, 2004 3:13 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] "Unconfirmed" list proof-of-concept > > > >All, > >I'm *really* glad to see all of the lively discussion going on here >regarding the grey list / uc idea. That alone, I think, speaks to the >potential of such an idea. However, as Raymond and Jeff have both >pointed out, they're not at all keen on including this in the SURBL >project itself, and want to keep mailing list traffic down. > >I respect that. I also still think there's a lot of merit to the UC >list. I'd like to protect SURBL's interests, and make the new list >happen. So, I'd encourage anyone interested in the grey list / uc idea >to contact me off-list at <ryan(a)sasknow.com> so we can get organized, >move forward, and also respect the wishes of the fine surbl.org folks. +1 here. Look mom! I have another project! :) I think I'll start an Apache project that attempts to combine other Apache projects! Woot! --Chris (The pimp daddy to open source antispam.)

2 1

To MUNGE to not to MUNGE
by Ryan Thompson 03 Sep '04

03 Sep '04

Early mornin' rant: I know the SURBL.org FAQ documents the use of "MUNGED" to munge URIs for discussion. Personally, I think it's silly to do that while sending to this list, especially since, in the same heading, SURBL.org also suggests "It's probably a good idea to use less filtering on your anti-spam mailing list messages, or even to whitelist them". I think that's a much better idea, and everyone here should be doing that anyway, since live spams do often appear on this list. I know I do. The MUNGED is largely unnecessary, takes time to deal with, and (just as it is supposed to) stops automatic URI parsing, and even severely impairs human URI parsing, to the point that I go cross-eyed after spending half an hour reading the finer points on why "someMUNGEDwebsite.com" should be whitelisted. Oh, by the way, SpamAssassin, at least (and all others that I'm aware of), will not even parse body tokens of the form domain.com or 127.0.0.2 as URIs. And, again, "use less filtering on your anti-spam mailing list messages", if you aren't already. I see no reason to MUNGE domains posted to this list. Unless someone has some really compelling evidence to the contrary, could we please curb this silly practice before it really becomes a silly collective habit? :-) - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

8 16

Spammer or not: cyberpolice.ru
by Jeff Chan 03 Sep '04

03 Sep '04

cyberpolice.ru just got added to sc.surbl.org. Does anyone know if they are spammers or not? Jeff C.

5 7

"Unconfirmed" list proof-of-concept
by Ryan Thompson 03 Sep '04

03 Sep '04

As some of you may have read, I have set up an "unconfirmed" ("uc") list (or grey list), ready for submissions. It seems to me that there are at least a few active members of this list interested in giving this a shot. Currently, I am the only one with access to the data, but this can easily be changed to include a small number of trusted individuals with an interest in helping out. Here's how it works (and I'm putting this out as a starting point for discussion, not the gospel!) 1. When classifying domains for SURBL, continue to employ the same level of effort you do to find all domains worthy of blacklisting, and submit those to the usual sources. 2. For the domains that don't fit black lists or white lists, they *may* be candidates for uc. However, we only want to list domains in uc that are highly spammy, with only very small potential for legitimate use. HOW TO SUBMIT: a) Chris Santerre has suggested domains for inclusion in uc be posted to the SURBL mailing list, and only be included after receiving a total of three votes. I'll go with that, and suggest using a Subject like "UC: domain.com" for easy spotting. b) I'd also encourage submitters to email the submission address, uc(a)sasknow.com, with private submissions of one or more domains, one per line. I'll handle private submissions in the same way as mailing list submissions; if I get three separate private submissions for the same domain (or maybe two, plus my own hand-checked vote), I'll list the domain in uc. I'll track the number of unique submissions in the TXT field. I'd suggest whitelisting through the usual channels. Suggestions (public or private) on the submission and inclusion criteria are most welcome. I've tried to capture the gist of what others have seemed to best agree on, but there is probably room for improvement. I can throw up a quick web site once things solidify a little. Once the list grows to sufficient size (maybe 100-200 domains?), we should be able to get a good idea of the usefulness. Once that happens, it will probably be more obvious how public we should make the data. - Ryan -- Ryan Thompson <ryan(a)sasknow.com> SaskNow Technologies - http://www.sasknow.com 901-1st Avenue North - Saskatoon, SK - S7K 1Y4 Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon Toll-Free: 877-727-5669 (877-SASKNOW) North America

2 3

Re: [SURBL-Discuss] "Unconfirmed" list proof-of-concept
by Rob McEwen 03 Sep '04

03 Sep '04

Another good reason for the compromise I recommened in my last message is that me, Ryan, Chris, & others supporting unconfirmed.surbl.org would, essentially, get our list... it just wouldn't be servered automatically DNSRLB-style. But anyone would be free to copy this list and integrate it into their own private filtering rules as they desired. Someone might say... this is slower and less responsive than DNSRLB checking... I'd respond that it is the hardcore spammers that Jeff is referring to that are the fast moving target. FlowGo types tend to stay put with the same domains anyway (or, least they don't trade them out ever few hours or days). Also, wouldn't this list be higher quality with our combined efforts rather than just a few of us working on our own? Rob McEwen

1 0

← Newer
1
...
16
17
18
19
20
21
22
23
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss September 2004