Discuss

discuss@lists.surbl.org

1 participants
1864 discussions

[SURBL-Discuss] Help answering install questions on spamassassin-users?
by Jeff Chan 12 Apr '04

12 Apr '04

Can I ask for some help in answering some of the SpamCopURI install questions that are coming up on spamassassin-users? Looks mostly like out of date or missing modules. TIA! Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

2 3

Fwd: Re: SURBL Poisoning?
by Jeff Chan 12 Apr '04

12 Apr '04

This is a forwarded message From: Jeff Chan <jeffc(a)surbl.org> To: spamassassin-users(a)incubator.apache.org Date: Monday, April 12, 2004, 1:12:45 PM Subject: SURBL Poisoning? ===8<==============Original message text=============== On Monday, April 12, 2004, 7:21:23 AM, Jeff Koch wrote: > I have not tried SURBL yet but I'm concerned about what would happen if > spammers started loading their emails up with links to legitimate websites > - like paypal - ebay - chase - expedia, etc. Are you doing a manual review? I am doing a manual review, but need to find a way to share that load. Perhaps we can set up another discussion list and I can gateway the new additions to the list to it. Marc Perkel gave me access on his phpbb but I have not had time to work with it. A bulletin board with voting mechanism and a way to feed new domains into threads under a "spam or ham" board might be ideal. Anyone who could help implement that would be gratefully thanked. There is an internal whitelisting mechanism in sc.surbl.org that prevents legitimate domains like ebay, etc. from ever getting added to the list, and it seems quite effective. Anyone who has whitelists of common fp popular domains to share would be greatly appreciated also. However the primary defense against FPs is in the care SpamCop users take in *unchecking* legitimate looking URIs when they submit their reports. That also seems pretty effective at preventing FPs, as the whitelist is small yet useful. A log of the domains as they get added to the list can be found at: http://www.surbl.org/top-sites-domains.new.log If anyone spots any FPs, please forward them to me. Note also that version 2 of the data engine should have better spam detection and a similar low false positive rate, all automatically. Hope this helps, Jeff C. ===8<===========End of original message text=========== -- Jeff Chan mailto:jeffc@surbl.org-nospam http://www.surbl.org/

2 1

Re: SURBL & BigEvil
by Jeff Chan 12 Apr '04

12 Apr '04

On Monday, April 12, 2004, 8:59:21 AM, Burnie Burnie wrote: > Paul Barbeau <Paul(a)hypernet.ca> wrote: >> There still might be a place for BigEvil in this new world of SURBL. I find >> there are a number of domain in BigEvil (and my own MidEvil) that are not >> yet in the spam cop and therefore not in this service. Because of this >> there might still be a place for this type of list as you could call it more >> cutting edge. > Another issue to SURBL vs BigEvil: > If the spammer uses redirectors for urls, AFAIK only BigEvil > will match those. > SURBL will only check the hostname of the redirector. > I.e. http://drs.yahoo.com/covey/parr/*http://spammer.address/ > Perhaps this (and tinyurl, etc.) is an issue to be discussed? Here's a finer point to add the discussion. SpamCop itself does seem to disambiguate (most of) the redirection. If someone is using a redirector to send traffic to spamdomain.com, SpamCop seems to detect and resolve if correctly to spamdomain.com most of the time. So the data that's used as input to sc.surbl.org already has redirectors correctly handled to some extent. The SA code using sc.surbl.org such as SpamCopURI and urirhdbl may or may not be as capable of detecting and resolving the redirections. I can't really say for sure because I have not reviewed that code. My focus is on more the data side of things. Certainly it would be useful of the code handling messages coming in from the wild were able to resolve redirections fully, but I'm not sure that's currently the case. This is why we do these projects openly: so other people can add fixes, improve install scripts, add new features, etc. > BTW: Currently my stats show that of all recognized spam > during the last ~85 hours (- 12919 spam) > - 62.3% is in "sc.surbl.org" > - 76.3% is in "sbl-xbl.spamhaus.org" (127.0.0.2) > - 82.3% is in either/both of those > - 2.4% were put "over the edge" because of those rules > The last percentage is a bit low due to running bigevil, > sa-blacklist.uri and quite a bunch of other rules. Thanks for sharing the stats! I hope to be able to increase the spam detection rates significantly for sc.surbl.org when I get back to coding.... ;-) Jeff C. -- Jeff Chan mailto:jeffc@surbl.org-nospam http://www.surbl.org/

1 0

Re: Please sanity check sa.surbl.org announcement
by Daniel Quinlan 12 Apr '04

12 Apr '04

Jeff Chan <jeffc(a)surbl.org> writes: > Dooh, I think I just realized you were asking whether multiple > RBLs could be supported from a single query inside SA, and not > whether we could combine the lists on the RBL side. Pardon my > misinterpretation if that was your original meaning. Yes, that is what I was asking. You could continue to support separate zones as well for people who want to mirror them. You seem to still have a tendency to reject ideas before reading them through. I'm not saying I've never made the same mistake, but this is getting old. -- Daniel Quinlan anti-spam (SpamAssassin), Linux, http://www.pathname.com/~quinlan/ and open source consulting

1 0

Howdy
by Doc Schneider 12 Apr '04

12 Apr '04

Just wanted to say hi! And thanks Jeff and Raymond for the new lists. -- -Doc --- MomNDoc Online Consultants http://www.maddoc.net/ momndoc(a)maddoc.net

4 12

Re: [SURBL-Discuss] Trouble installing SpamCopURI-0.09
by Jeff Chan 12 Apr '04

12 Apr '04

On Sunday, April 11, 2004, 5:16:35 PM, Ed Kasky wrote: > At 3:36pm -0700 4/11/04, Jeff Chan wrote: >>it looks to me like it may be >>an incompatibility between Storable versions. Can you try updating >>your p5-Storable from CPAN? > That seems to have solved it!! I updated Storable via cpan and both > test and install ran fine. > I will start to watch for hits.... > thanks!!!! Glad to help! Please let us know how things go. You may want to try the alternate list sa.surbl.org also: http://www.surbl.org/ Note however that we will probably be changing the name of sa to something like sb or ws in the near future at the request of some SpamAssassin folks to reduce some potential confusion about the origins of the RBL. We're just trying to settle on a new name. I suppose we should pick one soon. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

Re: [SURBL-Discuss] Trouble installing SpamCopURI-0.09
by Jeff Chan 12 Apr '04

12 Apr '04

On Sunday, April 11, 2004, 3:07:33 PM, Ed Kasky wrote: > I am running SA 2.63 on RedHat 7.2 and get the following errors on > all tests when trying to install SpamCopURI-0.09: > [root@yoda2 Mail-SpamAssassin-SpamCopURI-0.09]# make test > cp bin/spamcopuri-update blib/script/spamcopuri-update > /usr/bin/perl "-MExtUtils::MY" -e "MY->fixin(shift)" > blib/script/spamcopuri-update > PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" > "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t > t/bad.............."lock_store" is not exported by the Storable > module at > /usr/src/Mail-SpamAssassin-SpamCopURI-0.09/blib/lib/Mail/SpamAssassin/SpamCopURI.pm > line 8 Hi Ed, I'm by no means a perl guru, but it looks to me like it may be an incompatibility between Storable versions. Can you try updating your p5-Storable from CPAN? Also what perl version are you running? Hopefully some of the more perl-culture-aware folks here will be able to chime in with some help. Here's fine for these questions, though we've also solved some together on spamassassin-users. Jeff C.

3 2

[SURBL-Discuss] Re: [SURBL-Announce] Lists archivess are available at correct URL
by Raymond Dijkxhoorn 12 Apr '04

12 Apr '04

Hi! > Looks like the list archive links need a slight fix. > Currently the URLs have the host as "localhost.localdomain" > where that should be "lists.surbl.org" instead. Let me ask > Raymond to please update that config in Mailman. :-) In the > meantime all the list archives can be found at: I'll have a look. also noticed that. > http://lists.surbl.org/pipermail/announce/ > http://lists.surbl.org/pipermail/discuss/ > > http://lists.surbl.org/pipermail/zones/ That last one is only available when loggin in (with the appropriate rights), so only list members can see that one. Thats working right now allready. Its a restrcited list, so the archives should also be :) Bye, Raymond.

2 2

Trouble installing SpamCopURI-0.09
by Ed Kasky 12 Apr '04

12 Apr '04

I hope this is an appropriate list to post this sort of problem. If not, please pardon the interuption and let me know which list is best. I am running SA 2.63 on RedHat 7.2 and get the following errors on all tests when trying to install SpamCopURI-0.09: [root@yoda2 Mail-SpamAssassin-SpamCopURI-0.09]# make test cp bin/spamcopuri-update blib/script/spamcopuri-update /usr/bin/perl "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/spamcopuri-update PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/bad.............."lock_store" is not exported by the Storable module at /usr/src/Mail-SpamAssassin-SpamCopURI-0.09/blib/lib/Mail/SpamAssassin/SpamCopURI.pm line 8 Can't continue after import errors at /usr/src/Mail-SpamAssassin-SpamCopURI-0.09/blib/lib/Mail/SpamAssassin/SpamCopURI.pm line 8 BEGIN failed--compilation aborted at /usr/src/Mail-SpamAssassin-SpamCopURI-0.09/blib/lib/Mail/SpamAssassin/SpamCopURI.pm line 8. Compilation failed in require at t/bad.t line 5. BEGIN failed--compilation aborted at t/bad.t line 5. t/bad..............dubious Test returned status 255 (wstat 65280, 0xff00) DIED. FAILED tests 1-5 Failed 5/5 tests, 0.00% okay thanks in advance for any hints... Ed Kasky Randomly Generated Quote: No problem is so formidable that you can't just walk away from it.

1 0

[SURBL-Discuss] Re: [SURBL-Zones] sa.surbl.org TXT message shanged to add URI
by William Stearns 11 Apr '04

11 Apr '04

On Sun, 11 Apr 2004, Jeff Chan wrote: > I've udpated the TXT message for the sa list, addding a URI: > > "Message body contains domain in sa-backlist." > > to: > > "Message body contains domain in sa-backlist. See: http://www.stearns.org/sa-blacklist/" > > This makes for a slightly larger BIND zonefile, but it's perhaps > more descriptive. Comments please to discuss(a)lists.surbl.org . Looks good, except sa-backlist needs another "l". *smile* Cheers, - Bill --------------------------------------------------------------------------- "Toleration is an inner personal disposition, is a fundamental requirement of being human and of living together in society . . .When toleration becomes indifference, it is ruined." -- Van Ruler (Courtesy of Tim Hawes <thawes(a)dma.org>) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

2 1

Re: Please sanity check sa.surbl.org announcement
by Jeff Chan 11 Apr '04

11 Apr '04

On Sunday, April 11, 2004, 12:29:43 AM, Daniel Quinlan wrote: > Jeff Chan <jeffc(a)surbl.org> writes: >> Can any 3.0 guys able to comment if I got the urirhsbl syntax correct: > It's correct, but you might not need to get it correct because the rule > will likely ship with 3.0 when it is released if it seems to work well > and it helps. Let's hope that proves to be the case. :-) Would you please do a spam and ham corpora check with "sa.surbl.org" whenever you can? We'd really like to know any false positives to remove if that's possible to determine. > I have a concern about the rule. Bill Stern's SpamAssassin blacklist is > a blacklist *for* SpamAssassin, so I think the naming of your rule and > the DNSBL name (sa.surbl.org) are unintentionally a bit misleading since > the list is not maintained by the ASF or SpamAssassin. I think it would > be a good idea to rename the DNSBL and the rule to make this clearer. > Maybe we should encourage (or help) Bill Stern to pick a snappy name. > :-) Fair enough. I picked sa.surbl.org out of thin air since his rule started with "sa" and to give oblique credit to the original motivation for his rule, if not the precise source. Bill, anyone, got some better names? I prefer two letters. (sa and sc were kind of confusing anyway.) "sb" for Sa-Blacklist anyone? LOL! ;-) > Also, it would be better from our perspective if we could get multiple > RBL results from a single query to reduce overhead. Any of multiple A > (like NJABL, SBL/XBL, or SORBS), bitmask A (like OPM or RBL+), or > multiple TXT (like SBL/XBL) would probably not be too hard to support > (Justin?). We deliberately did not want to combine Bill's list and mine not so much due to not-invented-here syndrome but because their source data is so different, and because their size and time factors are pretty radically different at present. I gave some of the original reasons in the proposed announcement which I had not forwarded here yet, but will now. >> P.S. If we can get some 3.0 developers on discuss(a)lists.surbl.org, >> perhaps we can take the talk there. > Carbon-coping spamassassin-dev(a)incubator.apache.org (which is public) > for SpamAssassin issues (all versions) is probably the easiest way to > get SpamAssassin developers involved in a discussion. OK Cross-posting it is... :-| LOL! Jeff C. -- Jeff Chan mailto:jeffc@surbl.org-nospam http://www.surbl.org/

2 2

Re: Please sanity check sa.surbl.org announcement
by Jeff Chan 11 Apr '04

11 Apr '04

On Sunday, April 11, 2004, 12:29:43 AM, Daniel Quinlan wrote: > Also, it would be better from our perspective if we could get multiple > RBL results from a single query to reduce overhead. Any of multiple A > (like NJABL, SBL/XBL, or SORBS), bitmask A (like OPM or RBL+), or > multiple TXT (like SBL/XBL) would probably not be too hard to support > (Justin?). Dooh, I think I just realized you were asking whether multiple RBLs could be supported from a single query inside SA, and not whether we could combine the lists on the RBL side. Pardon my misinterpretation if that was your original meaning. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org-nospam http://www.surbl.org/

1 0

Re: [SURBL-Discuss] surbl.com and surbl.net registered
by Doc Schneider 11 Apr '04

11 Apr '04

Jeff Chan <jeffc(a)surbl.org> wrote .. > FWIW I just registered surbl.net and surbl.com to prevent > doofuses from registering them and setting up bogus RBLs on > them, as I recall happened to another RBL. > > Also set up an Apache redirect permanent for them to > www.surbl.org, which remains the real domain. > > Cheers, > > Jeff C. > Awesome Jeff. I always registered the big three for all my domains too. Might also want to considering grabbing surbl.us seems more and more folks are geting those too. -Doc

2 1

surbl.com and surbl.net registered
by Jeff Chan 11 Apr '04

11 Apr '04

FWIW I just registered surbl.net and surbl.com to prevent doofuses from registering them and setting up bogus RBLs on them, as I recall happened to another RBL. Also set up an Apache redirect permanent for them to www.surbl.org, which remains the real domain. Cheers, Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss