- Discuss - Mailman 3

foothill .net Joe jobbed?
by Chris Santerre 15 Dec '04

15 Dec '04

I see lots of NANAE and NANAS hits for foothill .net, but they all seem to be Joe Jobs. Anyone know why? Are they legit? They have requested removal from SURBL listing. I'm leaning towards removal at this point. Chris Santerre System Admin and SARE/SURBL Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

3 3

RE: MISC: rm04.net, silverpop.com
by Chris Santerre 14 Dec '04

14 Dec '04

>-----Original Message----- >From: Todd Vierling [mailto:tv@DUH.ORG] >Sent: Tuesday, December 14, 2004 10:30 AM >To: SPAM-L(a)PEACH.EASE.LSOFT.COM >Subject: Re: MISC: rm04.net, silverpop.com > > >On Tue, 14 Dec 2004, Chris Santerre wrote: > >> This morning I received a spam from silverpop. They have >been known to be >> pretty whitehat. > >Interesting planet on which you live. They've been blanket >blocked here >due to severe lack of closed-loop confirmation since early 2003, and to >this day, they still try to whack my server several times a month. 8-) > >-- >-- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com> I just got off the phone with Mr. Roberts. He is very pleasant. He even knows you Todd :) He is looking into the UCE I received this morning. They still seem white'ish in my eyes. Will see what happens. --Chris

1 0

Thunderbird and SURBL?
by Chris Santerre 14 Dec '04

14 Dec '04

Thinking out loud.... Anyone have contact with thunderbird devs? Could a pop proxy be used to check emails being downloaded by thunderbird on SURBL, then decline to download the ones that hit? Obviously with whitelist bypasses? Then the user could use a web client to delete spams without downloading? Or whatever..... Chris Santerre System Admin and SARE/SURBL Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

2 1

RE: [SURBL-Discuss] surebase.com?
by Chris Santerre 13 Dec '04

13 Dec '04

> >I don't think Deerfield has anything to do with surebase.com >except as registrar, or it's a joe job against Deerfield. > That was my first thought as well. --Chris

1 0

surebase.com?
by Jeff Chan 12 Dec '04

12 Dec '04

Anyone heard of: Deerfield Communications Inc. 4241 Old U.S. 27 South Gaylord, MI 49735 US Domain Name: SUREBASE.COM Administrative Contact - M.N.Lopes daSilva - tropical(a)ve.net SureBase.com c/o Technical Web Edf Santiago de Leon, Piso 2, Ofic 21, Av-Casanova Caracas, 1010 VE Phone - 01127618432 Fax - Technical Contact - HostMaster DNS2Go - hostmaster(a)DNS2Go.com Deerfield Communications Inc. 4241 Old U.S. 27 South Gaylord, MI 49735 US Phone - (517) 732-8856 Fax - (517) 731-2642 Billing Contact - M.N.Lopes daSilva - tropical(a)ve.net SureBase.com c/o Technical Web Edf Santiago de Leon, Piso 2, Ofic 21, Av-Casanova Caracas, 1010 VE Phone - 01127618432 Fax - Record update date - 2004-05-27 09:50:52 Record create date - 2000-05-13 Record will expire on - 2005-05-13 Database last updated on - 2004-12-11 19:13:36 EST Domain servers in listed order: NS.TUCONDOMINIO.COM 66.227.4.217 NS2.TUCONDOMINIO.COM 66.227.4.218 I got a spam sent straight from their server NS.TUCONDOMINIO.COM 66.227.4.217 mentioning domains: joysongcreations.com surebase.com joysongcreations.com is relatively new and has no RBL, SBL or NANAS. surebase.com was registered in 2000, has no RBL or SBL but has 4000+ NANAS. This one is puzzling. Anyone have more info? Jeff C. -- "If it appears in hams, then don't list it."

2 2

Re: [SURBL-Discuss] RFC: consensus list?
by Frank Ellermann 11 Dec '04

11 Dec '04

Jeff Chan wrote: > Ask application writers like SpamAssassin and others > to check or modify their code to be able to handle bits > in the other octets, i.e. 127.0.1.X, 127.64.X.X, etc. > Should we let them know ahead of time that their code > should be able to handle these cases without breaking? In rxwhois 1.7.1 dedicated to one "Jeff Chan" <eg> I've added support for either 127.0.X.Y or 127.1.X.Y. The latter is for OPM and allows up to 16 bits. For the former I now display 127.0.0.0/31 as "utter dubious". 2.0.0.127.wadb.isipp.com = 127.0.0.1, I'll probably eliminate WADB, it's below my minimal standards for any well-behaved BL. We can discuss about more than 16 bits in 2006, is that okay ? > Comments? I'm not sure why OPM uses 127.1.0.Y instead of 127.0.0.Y. A simple explanation would be "avoid 127.0.0.0/31 like hell and allow up to 8 bits in Y". Another explanation could be "no 127.0.0.0/31, up to 16 bits in 127.1.X.Y, _and_ additionally a version number in the case of incompatible changes, starting with version 1 in 127.1.X.Y". Bye, Frank -- <http://purl.net/xyzzy/src/rxwhois.cmd> <http://purl.net/xyzzy/rxwhois.htm>

1 0

RE: [SURBL-Discuss] FP rate
by Chris Santerre 09 Dec '04

09 Dec '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, December 09, 2004 2:06 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] FP rate > > >On Wednesday, December 8, 2004, 8:51:04 PM, RD RD wrote: >> Hello List, > >> Is there an available % FP rate for SC and JP ? >> I thought I should ask to help me decide whether I should >keep dropping >> e-mails w/ blacklisted URIs. > >FP rates vary a lot depending on whose spam and ham corpra are >used, but here are some from SpamAssassin corpora against >older versions of the SURBL lists. Most of the SURBL lists >now have better FP rates due to cleanup we've been doing >along the way: > >OVERALL% SPAM% HAM% S/O RANK SCORE NAME >2424443 2357143 67300 0.972 0.00 0.00 (all messages) >100.000 97.2241 2.7759 0.972 0.00 0.00 (all messages as %) > 7.595 7.8122 0.0045 0.999 1.00 0.00 URIBL_SC_SURBL > 76.754 78.9448 0.0178 1.000 0.80 0.00 URIBL_OB_SURBL > 77.230 79.4340 0.0208 1.000 0.60 1.00 URIBL_PJ_SURBL > 0.985 1.0126 0.0045 0.996 0.50 0.00 URIBL_AB_SURBL > 82.119 84.4600 0.1367 0.998 0.40 0.00 URIBL_WS_SURBL > 0.021 0.0216 0.0045 0.829 0.00 0.00 URIBL_PH_SURBL I still can't believe SC is beating WS in FP rate!!! Bah!!!! Must reduce FP rate more!! Must perse thru thousands of domains.....mind going numb......... Ahhhh but look at the spam hit rates! Who's your daddy now?! :-) --Chris

4 4

SpamAssassin Discussion LIst
by Rob McEwen 09 Dec '04

09 Dec '04

Even thought I don't use SpamAssassin, from time to time, I desire to discuss and even contribute ideas related to developing or enhancing rules base filtering. Like SpamAssassin, the mail filter I use is capable of using Regular Expressions in a way that is similar to SpamAssassin. When I get the urge to post questions and suggestions, I keep thinking that the SURBL list is not the best targeted forum for this topic and I should probably join the SpamAssassin discussion group to discuss this topic. However, after searching, I now see that there is more than one list for SpamAssassin. Therefore, does anyone know **which** SpamAssassin list I should join (and where to subscribe) if I'm interested in rules development? Thanks, Rob McEwen

3 2

RE: [SURBL-Discuss] Feature Request: Whitelist_DNSRBL
by Rob McEwen (PowerView Systems) 09 Dec '04

09 Dec '04

Speaking of whitelisting, I'm using a caching dns server on my box which is based on BINDS. I currently use the following syntax in the names.config files to manually whitelist: zone "yahoo.com.multi.surbl.org" in { type master; }; This **works** and causes the DNS caching server to return a "not found" WITHOUT having to ever check external DNS servers to resolve this. Also, the return times are lightening fast (<4ms). However, I'm still getting some kind of weird system errors logged in my "Events" log related to this process. Basically, I think I goofed up the syntax or I am missing some information here. Does anyone here happen to be familar with BIND and have any suggestions as to the correct syntax? What **should** my example from above look like? Thanks, Rob McEwen

3 3

RE: Feature Request: Whitelist_DNSRBL
by Chris Santerre 09 Dec '04

09 Dec '04

>-----Original Message----- >From: Bill Landry [mailto:billl@pointshare.com] >Sent: Wednesday, December 08, 2004 11:04 AM >To: users(a)spamassassin.apache.org; discuss(a)lists.surbl.org >Subject: Re: Feature Request: Whitelist_DNSRBL > > >----- Original Message ----- >From: "Daryl C. W. O'Shea" <spamassassin(a)dostech.ca> > >> >> Was the whitelist you were referring to really the SURBL >server-side >> whitelist? >> > >> > >> > Yes! But local SURBL whitelists are needed to reduce >traffic and time. >> >> >> I'd much rather see SURBL respond with 127.0.0.0 with a >really large TTL >> for white listed domains. Any sensible setup will run a >local DNS cache >> which will take care of the load and time issue. > >I agree, and have suggested a whitelist SURBL several times on >the SURBL >discussion list, but it has always fallen on deaf ears - nary >a response. >It would be nice if someone would at least respond as to why >this is not a >reasonable suggestion. Well we have talked about it and .... didn't come up with a solid answer. The idea would cause more lookups and time for those who don't cache dns. We do have a whitelist that our private research tools do poll. The idea is that if it isn't in SURBL then it is white. This also puts more work to the already overworked contributors. ;) --Chris

5 7

Re: Feature Request: Whitelist_DNSRBL
by Jeff Chan 09 Dec '04

09 Dec '04

On Wednesday, December 8, 2004, 8:15:28 AM, David Hooton wrote: > The floor in offering a DNS based whitelist is that it encourages > people to place a negative score on it. The problem with this is that > spammers can poison messages with whitelisted domains, thereby > bypassing the power of the SURBL Agreed, that's another possible misuse of whitelists if they existed in RBL form. > The concept of "Whitelist" in the SURBL world is more of an "Exclusion > List" as in "we exclude these domains from being listed" rather than > we consider the presence of these domains in an email to be a good > sign of ham. Which is how we use them throughout SURBLs. There is no whitening of messages due to whitelist inclusion, only non-checking of whitelisted domains. That was a deliberate design decision IIRC. It seems to be revisited every so often, along with other design decisions, most of which I hope are mostly right. None of these decisions were made in a vacuum, we discussed most of them collaboratively and openly. Some of them were made when the project was just Eric Kolve and me, and some were later, but even two heads are better than one. :-) > An excluded domain is therefore ignored in all data and not allocated > a score positively or negatively, so trying to poison a message with > whitelisted domains is therefore pointless. Yep. > I think we either need to look at a DNS version of > uridnsbl_skip_domain with long TTL's or we should look at releasing a > .cf file. I personally think the more proper implementation may be > the DNS based version in order to avoid BigEvil type situations. The the solution we came up for SA 3 with of a small, hard-coded exclusion list seems to fit the data well and be somewhat optimal in terms of performance. An advantage of a separate local whitelist .cf might be for local programs to be able to output and maintain their own list, as Chris initially suggested. But I get back to the point that whitehats are pretty stable, and a hard coded list which anyone can edit or update locally in their existing 25_uribl.cf fits the data pretty well. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

Re: Feature Request: Whitelist_DNSRBL
by Bill Landry 09 Dec '04

09 Dec '04

----- Original Message ----- From: "Daryl C. W. O'Shea" <spamassassin(a)dostech.ca> > >> Was the whitelist you were referring to really the SURBL server-side > whitelist? > > > > > > Yes! But local SURBL whitelists are needed to reduce traffic and time. > > > I'd much rather see SURBL respond with 127.0.0.0 with a really large TTL > for white listed domains. Any sensible setup will run a local DNS cache > which will take care of the load and time issue. I agree, and have suggested a whitelist SURBL several times on the SURBL discussion list, but it has always fallen on deaf ears - nary a response. It would be nice if someone would at least respond as to why this is not a reasonable suggestion. Bill

3 2

Feature Request: Whitelist_DNSRBL
by Chris Santerre 09 Dec '04

09 Dec '04

OK, we know that the popular domains like yahoo.com and such are hard coded into SA to be skipped on DNSRBL lookups. But it would be great to have a function to add more locally. Thinking one step bigger, it would be even better to feed this a file. This way maybe SURBL can create a file for the top hit legit domains. Then using SARE and RDJ, people could update that. This would reduce a lot of traffic and time. This might also help with the mysterious bug we have seen where some local domains are being flagged as SURBL hit, when they aren't in SURBL. Perhaps whitelisting local domains so they are skipped would do away with this. Thoughts, suggestions, or coffee? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

4 3

RE: [SURBL-Discuss] RE: Feature Request: Whitelist_DNSRBL
by Dallas L. Engelken 08 Dec '04

08 Dec '04

> > > >Chris Santerre wrote: > >> Well we have talked about it and .... didn't come up with a > >solid answer. > >> The idea would cause more lookups and time for those who > >don't cache dns. We > >> do have a whitelist that our private research tools do poll. > >The idea is > >> that if it isn't in SURBL then it is white. > >> > >> This also puts more work to the already overworked contributors. ;) > > > >want to put me on the round robin list again? > > Yes I would, but I think it is broke. We have been trying to > get one person off, but haven't been able to. Security issue. > I'll let Dallas chime in on this one. > Ya, things are still tight where its hosted. When I get some time here, I'd like to assume responsibility for hosting rulesemporium.com if nobody cares. I've just been so fricken busy lately. Dallas

1 0

RE: [SURBL-Discuss] RE: Feature Request: Whitelist_DNSRBL
by Chris Santerre 08 Dec '04

08 Dec '04

>-----Original Message----- >From: Alex Broens [mailto:surbl@alexb.ch] >Sent: Wednesday, December 08, 2004 12:34 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] RE: Feature Request: Whitelist_DNSRBL > > >Chris Santerre wrote: >> Well we have talked about it and .... didn't come up with a >solid answer. >> The idea would cause more lookups and time for those who >don't cache dns. We >> do have a whitelist that our private research tools do poll. >The idea is >> that if it isn't in SURBL then it is white. >> >> This also puts more work to the already overworked contributors. ;) > >want to put me on the round robin list again? Yes I would, but I think it is broke. We have been trying to get one person off, but haven't been able to. Security issue. I'll let Dallas chime in on this one. --Chris

1 0

Re: Feature Request: Whitelist_DNSRBL
by Bill Landry 08 Dec '04

08 Dec '04

----- Original Message ----- From: "David Hooton" <david.hooton(a)gmail.com> > On Wed, 8 Dec 2004 08:03:35 -0800, Bill Landry <billl(a)pointshare.com> wrote: > > I agree, and have suggested a whitelist SURBL several times on the SURBL > > discussion list, but it has always fallen on deaf ears - nary a response. > > It would be nice if someone would at least respond as to why this is not a > > reasonable suggestion. > > The floor in offering a DNS based whitelist is that it encourages > people to place a negative score on it. The problem with this is that > spammers can poison messages with whitelisted domains, thereby > bypassing the power of the SURBL I agree, it should not be used as a HAM indicator, way too easy to abuse. I was suggesting that the whitelist be used as a way to exclude the domain from being constantly queried against the SURBL name servers. > The concept of "Whitelist" in the SURBL world is more of an "Exclusion > List" as in "we exclude these domains from being listed" rather than > we consider the presence of these domains in an email to be a good > sign of ham. Exactly. > An excluded domain is therefore ignored in all data and not allocated > a score positively or negatively, so trying to poison a message with > whitelisted domains is therefore pointless. Yep, agree wholeheartedly. > I think we either need to look at a DNS version of > uridnsbl_skip_domain with long TTL's or we should look at releasing a > .cf file. I personally think the more proper implementation may be > the DNS based version in order to avoid BigEvil type situations. Indeed, my thoughts exactly. Bill

1 0

RE: [SURBL-Discuss] Feature Request: Whitelist_DNSRBL
by Chris Santerre 08 Dec '04

08 Dec '04

>> Thoughts, suggestions, or coffee? > >First, where's that coffee? In my belly! >then: I keep a .cf file with a quite a few lines like. > >uridnsbl_skip_domain ibill.com blabla.tld local-boobie-site.dom Doh! It helps to RTFM I guess :) LOL at boobie-site! Seeing as this feature is in place and I'm just thickheaded, I'll talk with Jeff about creating a cf file, or the 127.0.0.0 issue. But I'm leaning towards the cf file for now. Stay tuned..... --Chris (Ooh baby do you know what that's worth, oooh heaven is a place on earth!)

1 0

RE: Feature Request: Whitelist_DNSRBL
by Chris Santerre 08 Dec '04

08 Dec '04

> >>Thinking one step bigger, it would be even better to feed >this a file. This >>way maybe SURBL can create a file for the top hit legit >domains. Then using >>SARE and RDJ, people could update that. This would reduce a >lot of traffic >>and time. > >Wait, now you're bringing SURBL into this.. are you talking >normal DNSRBLS, >or URIDNSBLS? Or both? Dang my brain!!! I meant URIDNSBLS!! Freaking too many abreviations in my head :) > >Was the whitelist you were referring to really the SURBL >server-side whitelist? Yes! But local SURBL whitelists are needed to reduce traffic and time. > >>This might also help with the mysterious bug we have seen >where some local >>domains are being flagged as SURBL hit, when they aren't in >SURBL. Perhaps >>whitelisting local domains so they are skipped would do away >with this. > >Agreed.. It would provide users a short-term fix, although really the >problem does need to be rooted out at some point.. > >>Thoughts, suggestions, or coffee? > >All of the above? Pouring a cup right NOW! --Chris

1 0

Re: Feature Request: Whitelist_DNSRBL
by Matt Kettler 08 Dec '04

08 Dec '04

At 10:17 AM 12/8/2004 -0500, Chris Santerre wrote: >OK, we know that the popular domains like yahoo.com and such are hard coded >into SA to be skipped on DNSRBL lookups. But it would be great to have a >function to add more locally. Um. They are?? AFAIK there are absolutely no whitelists to the DNSRBLs in SA itself. Don't confuse the "EXISTING_DOMAINS" list in DNS.pm with a whitelist. That's actually a list of domains that are used to test if your DNS is working if you don't have dns_available set to yes. SA does a quick MX query for one of the domains in the list, and if it gets an answer, it knows it's working... However, I do agree it would be nice to be able to have a DNSBL whitelist capability, if for no other reason than fixing any listings that might cause short-term FPs. >Thinking one step bigger, it would be even better to feed this a file. This >way maybe SURBL can create a file for the top hit legit domains. Then using >SARE and RDJ, people could update that. This would reduce a lot of traffic >and time. Wait, now you're bringing SURBL into this.. are you talking normal DNSRBLS, or URIDNSBLS? Or both? Was the whitelist you were referring to really the SURBL server-side whitelist? >This might also help with the mysterious bug we have seen where some local >domains are being flagged as SURBL hit, when they aren't in SURBL. Perhaps >whitelisting local domains so they are skipped would do away with this. Agreed.. It would provide users a short-term fix, although really the problem does need to be rooted out at some point.. >Thoughts, suggestions, or coffee? All of the above?

1 0

UGH.. More false positives
by Matt 08 Dec '04

08 Dec '04

I've got some more false positives.. this one appears to be my.yahoo.com !!! From: "Mark Roberts" <maxmedianews(a)yahoo.com> To: "WGRC" <news(a)wgrc.com> Sent: Tuesday, December 07, 2004 5:48 AM Subject: [SPAM] 12/7 > Spam detection software, running on the system "spamcobra.swift-networks.com", has > identified this incoming email as possible spam. The original message > has been attached to this so you can view it (if it isn't spam) or block > similar future email. If you have any questions, see > the administrator of that system for details. > > Content preview: M.Roberts 12/7/04 News [...] > > Content analysis details: (5.5 points, 5.0 required) > > pts rule name description > ---- ---------------------- ---------------------------------------------- ---- > 0.0 HTML_MESSAGE BODY: HTML included in message > 0.5 HTML_20_30 BODY: Message is 20% to 30% HTML > 5.0 SPAMCOP_URI_RBL URI's domain appears in SpamCop data at http://www.surbl.org/lists.html > [my.yahoo.com is blacklisted in URI RBL at] > [sc.surbl.org] > > The original message was not completely plain text, and may be unsafe to > open with some email clients; in particular, it may contain a virus, > or confirm that your address can receive spam. If you wish to view > it, it may be safer to save it to a file and open it with an editor. > > Subject: 12/7 From: Mark Roberts <maxmedianews(a)yahoo.com> Date: Tue, 7 Dec 2004 02:48:31 -0800 (PST) To: WGRC <news(a)wgrc.com> M.Roberts 12/7/04 News (Northumberland County)---A car and an oil-delivery truck crashed head-on yesterday afternoon in Northumberland County, killing a young Luzerne County woman. Northumberland County Coroner James Kelley identified the victim as 22-year-old Ann Marie Piasecki of Wilkes Barre. Route 487 was closed after the truck and car crashed about 1:30 p-m near the Fleetwood Motor Homes plant near Elysburg. A passenger in Piasecki's car was flown to Geisinger. Police continue to investigate yesterday's fatal Northumberland County Crash. (Montour County)---Plea negotiations are under way in the case of an Amish farmer accused of sexually assaulting several young girls at or around his farm in northern Montour County. The press enterprise says 47 year old Eli Hostetler, of Anthony Township, was granted a trial continuance at the request of defense attorney. Hostetler faces a host of charges including rape, corruption and child endangerment filed by state police at Milton. Some of the allegations made against him date back more than 11 years. (State)---When the Electoral College meets next week, 21 of Pennsylvania's staunchest Democrats will cast their electoral votes for defeated presidential nominee John Kerry. The state's electors will gather in the state House chamber December 13th, the day the 538 members of the Electoral College nationally cast ballots confirming President Bush's victory. (Drugs)---New research suggests that top-selling pain reliever Celebrex does not carry the same heart attack risk as Vioxx, a similar drug pulled from the market in September because of safety concerns. A study by University of Pennsylvania researchers is the first to compare the two arthritis drugs since the recall. (Columbia County)--- The new owner of the Columbia Mall in Buckhorn is promising more stores and a movie theater. Bayview Financial of Florida will take over the mall next month from Columbia Mall Associates. The current owners say the mall has lost nearly 20 (m) million dollars in value since 1995. (Luzerne County)--- The city of Wilkes-Barre has agreed to pay 225-thousand dollars for a former bank building in a prominent downtown location. The building that once housed the First National Bank has been vacant since the flood of 1972. City Leaders are looking at the idea of restoring it. (Northumberland County)---Three people were injured after a crash yesterday morning at route 54 and 44 in the boro of Turbotville, Northumberland County. State Troopers say the crash occurred as 77 year old Annabelle Temple of Milton was attempting to cross 54 when she pulled into the path of 67 year old Sylvia Lawrence of Riverside. Both Lawrence and Temple were transported to Geisinger for treatment. A 2 year old passenger with Temple also suffered minor injuries and was taken to the Evangelical Hospital for treatment after yesterday's crash in Northumberland County. (Perry County)---State Troopers are looking into a Burglary which occurred sometime yesterday afternoon at the Millerstown Town Moose in Greenwood Township, Perry County. Officers explain, suspects entered the building and removed an undetermined amount of money, before fleeing thru a side door. Anyone with information into that robbery yesterday afternoon at the Millerstown moose should contact authorities. (Flu)---More flu vaccine is on the way. The government plans today to announce the purchase some of the five million doses available from plants in Canada and Germany. The Food and Drug Administration has signed off on the safety of a portion of the supply after doing inspections and tests. (Pearl Harbor)---Today marks the 63rd anniversary of the attack on Pearl Harbor. Survivors are returning to the Hawaii site to honor the more than two-thousand soldiers who died in the Japanese surprise attack. (Bloomsburg)--- Bloomsburg has plans to draw up a budget for next year that would reduce property taxes by almost 6.7 percent, but would hike a tax on in-town workers from $10 to more than $35. Today's press enterprise reports the idea was brought up at a workshop meeting last night. The state Legislature recently passed a law allowing municipalities to raise the old occupational assessment tax from $10 up to $52. Bloomsburg Councilmen entered the night looking at a roughly $309,000 budget deficit for next year. (Montour County)---Montour County might lay off a few employees and raise taxes next year to balance its 2005 budget. According to the press enterprise, Montour County is allowed to raise property taxes by only 10 percent, which would mean about $20 more in property tax for the typical resident. Commissioners would not reveal any specific figures from the 2005 budget. They said they will release the tentative budget and new tax rates at their meeting on Thursday. (Dog License)---Don't forget to get lucky or rover his tags….2005 dog licenses go on sale this week. Licenses are required for all dogs more than three months old. If the animal is spayed or neutered, the license is $6. If they are not, the license is $8. In 2004, county treasurers and state agents sold licenses for more than 900,000 dogs. Do you Yahoo!? Meet the all-new My Yahoo! – Try it today!

4 9

a few URL blacklist sources
by Daniel Quinlan 07 Dec '04

07 Dec '04

A great source you probably already know about, Wiki URL blacklists, especially the ones edited on a Wiki: http://moinmaster.wikiwikiweb.de/BadContent http://www.emacswiki.org/cgi-bin/wiki?BannedContent Not quite sure how these are edited: http://spammers.chongqed.org/ or http://blacklist.chongqed.org/ http://www.jayallen.org/blacklist.txt Open source web proxy filter ... maybe willing to share their URL lists? Of course, this is not a spammer list as far as I know, but perhaps it can be used to amplify and verify SURBL whitelist (to eliminate things) or blacklists (to cross-check an addition). http://www.censornet.com/ Huge list of URL blacklists: http://spamlinks.openrbl.org/filter-bl.htm Worth trying something more elaborate? Provide the Wiki folks with a better infrastructure for banning URLs used in Wiki spam (which I'm fairly confident will correlate well with email spam). 1. Get multiple wikis to use a standard format for bad content lists, feed into a SURBL-based Wiki blacklist. 2. All SURBL blacklists can be used on supporting Wikis. So, SURBL gets a new blacklist (the best kind, one fed with a different type of source), Wikis get a much wider blacklist, etc. Daniel -- Daniel Quinlan http://www.pathname.com/~quinlan/

2 3

RE: [SURBL-Discuss] Re: a few URL blacklist sources
by Chris Santerre 07 Dec '04

07 Dec '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, December 07, 2004 1:13 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] Re: a few URL blacklist sources > >> http://www.emacswiki.org/cgi-bin/wiki?BannedContent > >> http://spammers.chongqed.org/ or http://blacklist.chongqed.org/ >> http://www.censornet.com/ > >> http://spamlinks.openrbl.org/filter-bl.htm >With theese in mind, would anyone like to help us research some >of these other possible sources that Daniel brings up? Multiple >opinions could be useful. > *snipped stagnant from above* I will research: >> http://spammers.chongqed.org/ or http://blacklist.chongqed.org/ Any takers on the others? --Chris

1 0

RE: [SURBL-Discuss] Hi I'm new and I like SURBL
by Paul Schwarz 07 Dec '04

07 Dec '04

In our scenario sbl-xbl at the MTA plus SURBL blocks 80% of spam... If I add greylisting the result goes up to over 95%. I use Xwall spam filter. I wish all SMTP servers were greylisting compliant - there are some interesting problems - bummer. Is anyone else recommending or not recommending greylisting and what are your experiences. Seems like surbl should get more effective over the years but right now it probably only stops 50% of our spam if used by itself. Paul Schwarz Stark Truss Company, Inc. Senior Network Administrator (330) 478-2100 -----Original Message----- From: Jeff Chan [mailto:jeffc@surbl.org] Sent: Wednesday, December 01, 2004 4:14 AM To: Paul Schwarz Cc: 'SURBL Discussion list' Subject: Re: [SURBL-Discuss] Hi I'm new and I like SURBL On Tuesday, November 30, 2004, 6:02:53 AM, Paul Schwarz wrote: > sbl-xbl.spamhaus.org - reject at SMTP level standard greylisting > SURBL - using multi.surbl.org Hi Paul, sbl-xbl at the MTA plus SURBL use should be an effective combination. It's what I've been recommending to other folks. Preventing spams from even entering your network using spamhaus is quite safe, fast and smart. Jeff C. -- "If it appears in hams, then don't list it."

5 4

RE: [SURBL-Discuss] www.rulesemporium.com down?
by Paul Schwarz 07 Dec '04

07 Dec '04

Seems up now. Paul Schwarz -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Thomas Kinghorn [MTNNS -Rosebank] Sent: Tuesday, December 07, 2004 4:36 AM To: SURBL Discussion list Subject: RE: [SURBL-Discuss] www.rulesemporium.com down? Same result. Looks down. Tom -----Original Message----- From: discuss-bounces(a)lists.surbl.org [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Martin Sent: 07 December 2004 11:29 AM To: discuss(a)lists.surbl.org Subject: [SURBL-Discuss] www.rulesemporium.com down? Or is it just here? Thanks / Martin _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss _______________________________________________ Discuss mailing list Discuss(a)lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss

1 0

www.rulesemporium.com down?
by Martin 07 Dec '04

07 Dec '04

Or is it just here? Thanks / Martin

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss