Discuss September 2004

discuss@lists.surbl.org

62 participants
229 discussions

Re: [SURBL-Discuss] Proposing a greylist
by Rob McEwen 03 Sep '04

03 Sep '04

> Good idea. Let's do it. I'll be able to submit more domains to *this* > list than I could to ws. It will finally give meaning to that pile of > domains I always end up with and get ulcers trying to classify as black > or white. For the record... and just to be sure... I vote that unconfirmed.surbl.org NOT contain those things that we tend to agree with as NOT being spam, but sometimes gets reported as spam by end users. For example, people sometimes forget that they really DID subscribe to a particular newsletter, and then complain about it as being spam. The SallyFoster.com site is a great example where a one-time e-mail is sent only at the request of a relative or friend. Another example is a legitimate newsletter with an open-loop signup page where someone signed up their friends or enemies (without their knowledge) for the newsletter.... not good practice, but if it represents a tiny fraction of that newletter's distribution, the newsletter is otherwise totally opt-in, and there are few to none NANAS hits... then this kind of stuff shouldn't get on the greylist. Instead, unconfirmed.surbl.org ought to be for those really hard to classify things that ARE getting NANAS hits, that DO hit spamtraps, but that have enough legitimate purposes to not get placed in the regular SURBL lists. If this advice is not heeded, then unconfirmed.surbl.org will get too convoluted and too bulky to be effective. Rob McEwen

3 2

Re: [SURBL-Discuss] Proposing a greylist
by Rob McEwen 03 Sep '04

03 Sep '04

>It would reduce overall traffic and >ease administration to include it in multi One thing that I failed to explain is that the software I use DOES report the return code, but was constructed to work with SURBL without giving a lot of thought to the idea of doing different things based particular return codes. It reports the SURBL code for every "hit" in the log files, but within the programming logic, the variable that can be acted on is assigned more of a yes/no as to whether or not there was a single valid hit. Therefore, not every SURBL has the option to do different things based on the return code. Also, it would be EASY... very easy... for an administrator who DOES have option to do different things based on return codes to not exercise these options and block ALL multi stuff, regardless of the return code. (All administrators are not going to be SURBL gurus) Rob McEwen

4 3

Immediate WL ASAP
by Chris Santerre 03 Sep '04

03 Sep '04

206.132.3.30/ Listed in SURBL. Bigfoot interactive. I don't doubt they might have been once used by spammers. But it is blocking junk mail from Target, the redneck superstore! Yeeehaaaawww! --Chris (I didn't munge!)

2 1

RE: [SURBL-Discuss] Proposing a greylist
by Chris Santerre 02 Sep '04

02 Sep '04

>-----Original Message----- >From: Bret Miller [mailto:bret.miller@wcg.org] >Sent: Thursday, September 02, 2004 1:45 PM >To: rob(a)powerviewsystems.com; SURBL Discussion list >Subject: RE: [SURBL-Discuss] Proposing a greylist > > >OK, OK... How about an "evilmulti" that included "unconfirmed", which >would increase surbl's data size and processing-- having to build two >multi lists, but would significantly reduce DNS query traffic since >those using the "unconfirmed" list and the "multi" list could use a >single query per URI instead of 2 per URI. > >Bret I say that can be determined after testing the list in general. But for now, mutli is no no. :) Now, lets say for giggles Jeff says, "OK I agree to test this theory." Uh....how do we submit to it? Where is it? And who took my screwdrivers from my basement? --Chris

2 1

Re: RE: [SURBL-Discuss] Proposing a greylist
by Rob McEwen 02 Sep '04

02 Sep '04

> OK, OK... How about an "evilmulti" that included "unconfirmed", which > would increase surbl's data size and processing-- having to build two > multi lists, but would significantly reduce DNS query traffic since > those using the "unconfirmed" list and the "multi" list could use a > single query per URI instead of 2 per URI. > > Bret Sounds like a good compromise to me.... maybe call it unconfirmed_and_multi.surbl.org ?? Rob McEwen

2 1

RE: Applying SURBL against blog comment spammers
by Chris Santerre 02 Sep '04

02 Sep '04

>-----Original Message----- >From: jm(a)jmason.org [mailto:jm@jmason.org] >Sent: Thursday, September 02, 2004 2:04 PM >To: Chris Santerre >Cc: 'jm(a)jmason.org'; Matthew Hunter; SATalk; SURBL Discuss >Subject: Re: Applying SURBL against blog comment spammers > > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > > >Chris Santerre writes: >> Which is NOT in SURBL!! (It will be today!) Because like Dr. >Evil this is a >> pre-emptive Shhh! It is just a matter of time before this >site is used in an >> email spam. I also see no difference between this blog spam >and email spam. >> At all! > >Chris -- if you chase it up, I've found that a lot of them have ROKSO >and SBL records -- they're the same bunch. (esp. the porn spammers.) > >- --j. I'm working, (OK two crazed ninjas are working) on something for the SURBL guys to make "chasing it up" MUCH easier. But you already reinforce what I thought. These are the same groups, so lets hurt them even more. There are sooooo many great antispam projects going around, getting them to work together is like...what was that quote.......herding cats. --Chris

1 0

RE: [SURBL-Discuss] Proposing a greylist
by Chris Santerre 02 Sep '04

02 Sep '04

>-----Original Message----- >From: Rob McEwen [mailto:rob@powerviewsystems.com] >Sent: Thursday, September 02, 2004 1:29 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Proposing a greylist > > >> Good idea. Let's do it. I'll be able to submit more domains to *this* >> list than I could to ws. It will finally give meaning to that pile of >> domains I always end up with and get ulcers trying to >classify as black >> or white. > >For the record... and just to be sure... I vote that >unconfirmed.surbl.org NOT contain those things that we tend to >agree with as NOT being spam, but sometimes gets reported as >spam by end users. > >For example, people sometimes forget that they really DID >subscribe to a particular newsletter, and then complain about >it as being spam. The SallyFoster.com site is a great example >where a one-time e-mail is sent only at the request of a >relative or friend. Another example is a legitimate newsletter >with an open-loop signup page where someone signed up their >friends or enemies (without their knowledge) for the >newsletter.... not good practice, but if it represents a tiny >fraction of that newletter's distribution, the newsletter is >otherwise totally opt-in, and there are few to none NANAS >hits... then this kind of stuff shouldn't get on the greylist. > >Instead, unconfirmed.surbl.org ought to be for those really >hard to classify things that ARE getting NANAS hits, that DO >hit spamtraps, but that have enough legitimate purposes to not >get placed in the regular SURBL lists. > >If this advice is not heeded, then unconfirmed.surbl.org will >get too convoluted and too bulky to be effective. > >Rob McEwen > Before reading the other new posts in this thread, I have to say one big "Hell Yeah!" to this. It's kind of what I meant, and I assumed everyone thought the same. I shouldn't have done that. Yes anyone added to an unclasified MUST be VERY spammy! and have legit hits. I'm not talking about someone who may have purchased a bad list, or got screwed by a marketer one time. an unclasified domain still has to hit everything that would put it on a blacklist. --Chris (Une Rafale De Tubes!)

1 0

RE: Applying SURBL against blog comment spammers
by Chris Santerre 02 Sep '04

02 Sep '04

>-----Original Message----- >From: jm(a)jmason.org [mailto:jm@jmason.org] >Sent: Thursday, September 02, 2004 12:28 PM >To: Matthew Hunter >Cc: SATalk; SURBL Discuss >Subject: Re: Applying SURBL against blog comment spammers > > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > > >Matthew Hunter writes: >> On Thu, Sep 02, 2004 at 09:36:29AM -0400, Chris Santerre ><csanterre(a)MerchantsOverseas.com> wrote: >> > >-----Original Message----- >> > >From: Jeff Chan [mailto:jeffc@surbl.org] >> > >Sent: Thursday, September 02, 2004 3:24 AM >> > >To: SATalk >> > >Cc: SURBL Discuss >> > >Subject: Re: Applying SURBL against blog comment spammers >> > >On Wednesday, September 1, 2004, 11:25:40 PM, Matthew >Hunter wrote: >> > >> I just whipped up some code to reject trackback/comment spam >> > >> using a SURBL as a data source. Unfortunately, the people >> > >> spamming my weblogs aren't in multi.surbl.org, so I >will have to >> > >> maintain my own local blacklist server. >> > >> The single most useful thing that could be done wrt >fighting spam >> > >> in weblogs would be an SURBL source that had the offending >> > >> domains in it. I would offer to make mine public, but I don't >> > >> have the IP to spare at the moment... >> > >> Does anyone know of an appropriate SURBL list? >> > >Hi Matthew, >> > >We could perhaps set up a separate SURBL for blog spammers. >> > >It would be a slight shift in focus since the other SURBLs are >> > >all for email spam. Can you give an idea of how many records >> > >you have? >> > >Also have you tried Jay Allen's MT-Blacklist/Comment Spam >> > >list: >> > > http://www.jayallen.org/comment_spam/ >> > >It would be interesting to look at your data to see if there's >> > >much overlap with our existing lists. In the case of Jay's data, >> > >there's nearly none. >> > Hell I'm feeling a little saucy this morning so lets mull >this over. This >> > goes against Jeff's thoughts. But if they are spamming, >then just add them >> > to SURBL. Does it matter if they spam email or blogs? To >me, not really. >> > Adding them to the regular SURBL is sure to cause them some pain. >> > >> > Legit domains still get removed. >> > >> > SO I say, go ahead and add them. However I would like to >see an example of a >> > spam'd blog. I've never seen one. >> >> Here some some examples of trackback spam, which is perhaps best >> thought of as an automated hat-tip protocol. Let me know when >> you've seen them so I can delete them. These are new since >> sometime yesterday, I think (the last time I deleted this >> stuff). My SURBL update hasn't been posted to this site yet or >> it would have stopped these. >> >> http://www.triggerfinger.org/weblog/servlet/trackback/164.jsp >> http://www.triggerfinger.org/weblog/servlet/trackback/449.jsp >> http://www.triggerfinger.org/weblog/servlet/trackback/2799.jsp >> http://www.triggerfinger.org/weblog/servlet/trackback/3947.jsp >> http://www.triggerfinger.org/weblog/servlet/trackback/5053.jsp >> http://www.triggerfinger.org/weblog/servlet/trackback/5324.jsp >> http://www.triggerfinger.org/weblog/servlet/trackback/5484.jsp >> http://www.triggerfinger.org/weblog/servlet/trackback/5519.jsp >> http://www.triggerfinger.org/weblog/servlet/trackback/5556.jsp > >! I hadn't seen trackback spam before... > >> There's no standard comment API so I haven't fallen victim to >> that yet. Other bloggers have, but usually delete the >> comments ASAP... For comments, though, the simpler solution is >> probably to require an active user session (eg, session cookie >> accepted and returned from an earlier page). That can be >> programmatically done but it's harder. Parsing the comments >> for spam sign like email is, I think, inevitable in the long >> term. Well, that or requiring accounts to post comments. > >sample comment spams are easy enough to find. Google for >"comments movable cialis" ;) Here's one: > > <http://patch.stanford.edu/MT/mt-comments.cgi?entry_id=4> > >- --j. GREAT example J! One links to : http://patch.stanford.edu/MT/mt-comments.cgi?__mode=red&id=25 which links to : buy-cialis.ws Which is NOT in SURBL!! (It will be today!) Because like Dr. Evil this is a pre-emptive Shhh! It is just a matter of time before this site is used in an email spam. I also see no difference between this blog spam and email spam. At all! --Chris

2 1

RE: [SURBL-Discuss] Proposing a greylist
by Chris Santerre 02 Sep '04

02 Sep '04

>-----Original Message----- >From: Ryan Thompson [mailto:ryan@sasknow.com] >> >> I'd rather focus on black lists for the upstream mail servers. > >Go ahead! :-) Bwahahahahahha......if you only knew how funny that line was! :) So is that where it came from Jeff? ;) --Chris

1 0

uribl.cgi broken?
by Mariano Absatz 02 Sep '04

02 Sep '04

AFAIK, nic.ar never had a whois service... only queries via web... in fact, at one point, the output of the web query was a .gif autogenerated... I think it's now again plain text, so you should be able to automatically query it using LWP or something along the lines (it only accepts POSTs not GETs). -- Mariano Absatz - El Baby el (dot) baby (AT) gmail (dot) com el (punto) baby (ARROBA:@) gmail (punto) com

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss September 2004