Discuss

discuss@lists.surbl.org

2 participants
1870 discussions

Jeff's whitelists
by William Stearns 26 Jul '04

26 Jul '04

Good evening, Jeff, I wanted to check in with you about some domains removed because of your whitelists. There are a few in particular I wanted to cover. gevalia.com and joingevalia.com: gevalia does a _lot_ of spam. nutrisystem.com: again, a lot of recent spam, just done with a bulk marketing firm as a front. spamarrest.com: spammers themselves Any sense on the above? Cheers, - Bill --------------------------------------------------------------------------- "Hackers do not feel that leisure time is automatically any more meaningful than work time. The desirability of both depends on how they are realized. From the point of a view of a meaningful life, the entire work/leisure duality must be abandoned. As long as we are living our work or our leisure, we are not even truly living. Meaning cannot be found in work or leisure but has to arise out of the nature of the activity itself. Out of passion. Social value. Creativity." -- Andrew Leonard <aleonard(a)salon.com> http://salon.com/tech/col/leon/2001/02/05/hacker_ethic/index2.html -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

11 36

RFC: Drop multi.surbl.org rbldnsd TTL?
by Jeff Chan 26 Jul '04

26 Jul '04

Should we decrease the TTL on the rbldnsd version of multi.surbl.org? For some background on the issue, rbldnsd does not support setting individual TTLs per record for dnset type zones, so we could not set individual TTLs on the rbldnsd records in multi.surbl.org, so the TTL for all records in the rbldnsd version of multi are the default for the entire file which is currently 28800 (8 hours). Obviously that's quite a bit longer than the 90 minutes now used on ws or the 10 minutes for sc, so some multi/rbldnsd records may be longer-lived than their BIND versions. This is in conflict with the fact that we can and do set individual TTLs per record in the *BIND* version of multi. So a particular record in BIND multi versus rbldnsd multi may very likely have different TTLs, which is an asymmetry and somewhat inelegant. In other words a server that uses BIND may not give the same TTL for a given entry that an rbldnsd one would. One solution to this would be to drop the default rbldnsd TTL for multi to something short like 10 minutes to force them all to expire quickly. Does anyone have any thoughts about this? Would this result in a lot more DNS traffic in general? I could probably read the RFCs or source code, but does anyone know if DNS implementations cache negative hits to the default TTL. In other words if a new record gets added to a list, do caching name servers (that negatively cached it before, i.e., got queried and said "I don't have that") get the new record immediately or only after some TTL expires. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

2 2

[SURBL-Discuss] {Spam?} FOLLOW-UP: someone found a way to beat SURBL
by Rob McEwen 26 Jul '04

26 Jul '04

FOLLOW-UP: someone found a way to beat SURBL Jeff, I said... "I purposely did not send this to the discussion group" I think I goofed and DID accidentally send that last message to the discussion group. Sorry about that. Perhaps you could intercept it and/or remove it. Sorry for the trouble. Thanks, Rob McEwen PowerView Systems rob(a)PowerViewSystems.com (478) 475-9032

2 1

FP: blogonevent dot com
by Steven Champeon 26 Jul '04

26 Jul '04

FP on this domain in a post to sociate-talk. -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today! http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/

2 1

www.allnewmessenger.com
by Bitz 25 Jul '04

25 Jul '04

Hello List, Somehow this URI http://www.allnewmessenger.com is listed at ob.surbl.org. >> Yahoo! Messenger - all new features - even more fun! >> http://www.allnewmessenger.com Regards, -B

2 3

FPs?
by Steven Champeon 24 Jul '04

24 Jul '04

fsbconferences.com, wedecide2004.com Both showed up in legit WITI mailing. -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today! http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/

3 2

FW: False positive on Big Evil
by Chris Santerre 23 Jul '04

23 Jul '04

I agree with Jonathan, these guys should be whitelisted. --Chris >-----Original Message----- >From: Hall J D (ISeLS) [mailto:jdhall@glam.ac.uk] >Sent: Friday, July 23, 2004 7:41 AM >To: csanterre(a)merchantsoverseas.com >Subject: False positive on Big Evil > > >Hello Chris, > >I seem to be getting a false positive in the current >BigEvil.cf for http://emailuniverse.com > >They are an e-mail list hints and tips site. They're lists >seem to require a confirmation e-mail to subscribe to their >lists. My user who reported the false positive has confirmed >that she did sign up for the list so it's not unsolicited. > >Thanks, > >Jonathan >

2 1

Re: [SURBL-Discuss] ETA on New Version
by Jeff Chan 22 Jul '04

22 Jul '04

On Thursday, July 22, 2004, 1:43:58 PM, Rob McEwen wrote: > What is the TTL for the ob.surbl.org list? The TTL on ob is 6 hours. Maybe we should lower that. > Also, is the TTL for the multi.surbl.org list still > 6 hours? Could/will that ever be improved? Good question. RFCing lowering the TTL on multi was one of the things on my list of things to do... I'll ask now.... Jeff C.

1 0

Bitmasks on multi.surbl.org
by Mark 22 Jul '04

22 Jul '04

Hello, I just read about the new multi.surbl.org, and was wondering about its bitmask properties. Can you call multi.surbl.org with a multi-bitmask? Like 00111110? (127.0.0.62). To mean "Any of 2,4,8,16,32"? Probably not; but that would be real useful. Thanks, - Mark

2 1

Re: [SURBL-Discuss] ETA on New Version
by Rob McEwen 22 Jul '04

22 Jul '04

Jeff C. wrote: > Outblaze in particular seems to get domains quickly and > have a relatively low FP rate.... Great! What is the TTL for the ob.surbl.org list? Also, is the TTL for the multi.surbl.org list still 6 hours? Could/will that ever be improved? I'm still finding some spam getting through which shows up on the MULTI list the next day. Therefore, I'm thinking about checking BOTH multi.surbl.org AND ob.surbl.org. The idea is that, even though they overlap, I could catch everything but the newest stuff with multi.surbl.org and then possibly catch some newer stuff on ob.surbl.org that hasn't yet made it into the multi-surbl.org list. Follow?

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss