Discuss

discuss@lists.surbl.org

2 participants
1870 discussions

[SURBL-Discuss] Simple install instructions for spamcopuri0.09 on Win32
by ITReading ITReading 13 Apr '04

13 Apr '04

I have successfully installed SURBL support and have it up and running in my environment. I documented my procedures at www.aldridge-borden.com/surbl.html if anyone is interested. P.S. Jeff C, if you want to host this file somewhere on surbl.org, you certainly have my blessing. If its worth hosting. Even though the instructions are really simple, they have been helpful to some Win32 users as they often aren't too Perl savvy (I'm one of them!). Charles Solomon

1 0

make test fail - SpamCopURI.pm line 117
by Jason Portwood 13 Apr '04

13 Apr '04

Greetings, I'm trying to install SpamCopURI and I've hit a snag on the make test Here's what I'm getting: PERL_DL_NONLAZY=1 /usr/bin/perl -Iblib/arch -Iblib/lib -I/usr/libdata/perl/5.00503/mach -I/usr/libdata/perl/5.00503 -e 'use Test::Harness qw(&runtests $verbose); $verbose=0; runtests @ARGV;' t/*.t t/bad...............syntax error at blib/lib/Mail/SpamAssassin/SpamCopURI.pm line 117, near "$f :" BEGIN failed--compilation aborted at t/bad.t line 5. # Looks like your test died before it could output anything. dubious Test returned status 2 (wstat 512, 0x200) DIED. FAILED tests 1-5 My perl version is: This is perl, version 5.005_03 built for i386-freebsd. I also installed the URI perl module that was needed. Any thoughts on what could be going on? I may just move on to SpamAssassin 3.0 with the 3.0 plugin and see if it clears up. Thank you, Jason Portwood jason(a)wkrp.com

2 2

Slashdot about SURBL
by Jeff Chan 12 Apr '04

12 Apr '04

Made Slashdot: http://slashdot.org/ A New Type Of Realtime Blocklist: The SURBL Posted by timothy on Monday April 12, @05:02PM from the chicken-egg-spam dept. Glamdrlng writes "The SURBL, or "Spam URI Realtime Blocklist", represents a nexus of RBL's and content filtering that may bring us one step closer to a spam magic bullet. While traditional RBL's perform a DNS lookup on the connecting mail server, SURBL's take this a step further by parsing the text of the email looking for URI's and doing a lookup on those web servers. They also prevent "joe jobs" by maintaining a whitelist of legitimate web servers whose domain names may show up in spam messages, e.g. EBay, Paypal, Microsoft, etc. The only requirement to implement the SURBL is a plugin on your MTA such as spamassassin that can parse the body of each email. While there is no MTA that directly supports SURBL's without a plugin, the author hints at one being in development." http://yro.slashdot.org/yro/04/04/12/1956252.shtml?tid=111&tid=126&tid=95 Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

Ok you asked for it - lol
by Paul Barbeau 12 Apr '04

12 Apr '04

I can not get this to work and i know this is a double post so sorry about that I am using OpenBSD and i update Storable in CPAN and when i run "URI::QueryParam" i get "is up to date" however i am still getting t/bad..............ok t/blacklist........ok t/cache............ok t/dnsrbl...........NOK 5# Failed test (t/dnsrbl.t at line 25) t/dnsrbl...........ok 6/6# Looks like you failed 1 tests of 6. t/dnsrbl...........dubious Test returned status 1 (wstat 256, 0x100) DIED. FAILED test 5 Failed 1/6 tests, 83.33% okay t/good.............ok

2 1

Re: Please sanity check sa.surbl.org announcement
by Daniel Quinlan 12 Apr '04

12 Apr '04

Jeff Chan <jeffc(a)surbl.org> writes: > Would you please do a spam and ham corpora check with > "sa.surbl.org" whenever you can? We'd really like to know any > false positives to remove if that's possible to determine. Pretty high FPs. OVERALL% SPAM% HAM% S/O RANK SCORE NAME 11189 1200 9989 0.107 0.00 0.00 (all messages) 100.000 10.7248 89.2752 0.107 0.00 0.00 (all messages as %) 6.095 56.2500 0.0701 0.999 1.00 1.00 URIBL_SC_SURBL 6.855 59.7500 0.5006 0.992 0.98 1.00 URIBL_SBL 9.545 72.8333 1.9421 0.974 0.95 0.01 T_URIBL_SA_SURBL 0.116 0.5000 0.0701 0.877 0.58 0.01 T_URIBL_DSBL The FP rate is higher than even SBL (which gets some collateral damage with URIBL due to the domain->NS->A method that focuses in on name servers). A few of my FPs are actually legitimate anti-spam domains. > We'd really like to know any false positives to remove if that's > possible to determine. Since the list is not regenerated every 4 days, I'm not sure it's a good idea for SA corpus maintainers to submit false positives since the FP rate would then be lower for us, but not much lower for most people. In other words, it would introduce a large corpus bias. > We deliberately did not want to combine Bill's list and mine not > so much due to not-invented-here syndrome but because their > source data is so different, and because their size and time > factors are pretty radically different at present. I gave some > of the original reasons in the proposed announcement which I had > not forwarded here yet, but will now. You could continue to offer separate queries for people who are mirroring the zones. A lot of blacklists offer both separate and multiple queries. Daniel -- Daniel Quinlan anti-spam (SpamAssassin), Linux, http://www.pathname.com/~quinlan/ and open source consulting

2 1

problems with SpamCopURI
by Russ Ringer 12 Apr '04

12 Apr '04

Hi I need some help with SpamCopURI. I made sure these modules were up to date: cpan> install LWP LWP is up to date. cpan> install URI URI is up to date. cpan> install Storable Storable is up to date. But I get this error with make test: # make test cp bin/spamcopuri-update blib/script/spamcopuri-update /usr/bin/perl "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/spamcopuri-update PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/bad..............ok t/blacklist........ok t/cache............ok t/dnsrbl...........ok 4/6# Failed test (t/dnsrbl.t at line 25) t/dnsrbl...........ok 6/6# Looks like you failed 1 tests of 6. t/dnsrbl...........dubious Test returned status 1 (wstat 256, 0x100) DIED. FAILED test 5 Failed 1/6 tests, 83.33% okay t/good.............ok t/ipaddress........ok t/longhostname.....ok t/mailto...........ok t/merge_urls.......ok t/shorthostname....ok t/spamcop_fetch....ok t/spamcopuri.......ok t/whitelist........ok Failed Test Stat Wstat Total Fail Failed List of Failed ------------------------------------------------------------------------------- t/dnsrbl.t 1 256 6 1 16.67% 5 Failed 1/13 test scripts, 92.31% okay. 1/63 subtests failed, 98.41% okay. make: *** [test_dynamic] Error 11 TIA for your help, -->Russ

1 0

[SURBL-Discuss] Help answering install questions on spamassassin-users?
by Jeff Chan 12 Apr '04

12 Apr '04

Can I ask for some help in answering some of the SpamCopURI install questions that are coming up on spamassassin-users? Looks mostly like out of date or missing modules. TIA! Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

2 3

Fwd: Re: SURBL Poisoning?
by Jeff Chan 12 Apr '04

12 Apr '04

This is a forwarded message From: Jeff Chan <jeffc(a)surbl.org> To: spamassassin-users(a)incubator.apache.org Date: Monday, April 12, 2004, 1:12:45 PM Subject: SURBL Poisoning? ===8<==============Original message text=============== On Monday, April 12, 2004, 7:21:23 AM, Jeff Koch wrote: > I have not tried SURBL yet but I'm concerned about what would happen if > spammers started loading their emails up with links to legitimate websites > - like paypal - ebay - chase - expedia, etc. Are you doing a manual review? I am doing a manual review, but need to find a way to share that load. Perhaps we can set up another discussion list and I can gateway the new additions to the list to it. Marc Perkel gave me access on his phpbb but I have not had time to work with it. A bulletin board with voting mechanism and a way to feed new domains into threads under a "spam or ham" board might be ideal. Anyone who could help implement that would be gratefully thanked. There is an internal whitelisting mechanism in sc.surbl.org that prevents legitimate domains like ebay, etc. from ever getting added to the list, and it seems quite effective. Anyone who has whitelists of common fp popular domains to share would be greatly appreciated also. However the primary defense against FPs is in the care SpamCop users take in *unchecking* legitimate looking URIs when they submit their reports. That also seems pretty effective at preventing FPs, as the whitelist is small yet useful. A log of the domains as they get added to the list can be found at: http://www.surbl.org/top-sites-domains.new.log If anyone spots any FPs, please forward them to me. Note also that version 2 of the data engine should have better spam detection and a similar low false positive rate, all automatically. Hope this helps, Jeff C. ===8<===========End of original message text=========== -- Jeff Chan mailto:jeffc@surbl.org-nospam http://www.surbl.org/

2 1

Re: SURBL & BigEvil
by Jeff Chan 12 Apr '04

12 Apr '04

On Monday, April 12, 2004, 8:59:21 AM, Burnie Burnie wrote: > Paul Barbeau <Paul(a)hypernet.ca> wrote: >> There still might be a place for BigEvil in this new world of SURBL. I find >> there are a number of domain in BigEvil (and my own MidEvil) that are not >> yet in the spam cop and therefore not in this service. Because of this >> there might still be a place for this type of list as you could call it more >> cutting edge. > Another issue to SURBL vs BigEvil: > If the spammer uses redirectors for urls, AFAIK only BigEvil > will match those. > SURBL will only check the hostname of the redirector. > I.e. http://drs.yahoo.com/covey/parr/*http://spammer.address/ > Perhaps this (and tinyurl, etc.) is an issue to be discussed? Here's a finer point to add the discussion. SpamCop itself does seem to disambiguate (most of) the redirection. If someone is using a redirector to send traffic to spamdomain.com, SpamCop seems to detect and resolve if correctly to spamdomain.com most of the time. So the data that's used as input to sc.surbl.org already has redirectors correctly handled to some extent. The SA code using sc.surbl.org such as SpamCopURI and urirhdbl may or may not be as capable of detecting and resolving the redirections. I can't really say for sure because I have not reviewed that code. My focus is on more the data side of things. Certainly it would be useful of the code handling messages coming in from the wild were able to resolve redirections fully, but I'm not sure that's currently the case. This is why we do these projects openly: so other people can add fixes, improve install scripts, add new features, etc. > BTW: Currently my stats show that of all recognized spam > during the last ~85 hours (- 12919 spam) > - 62.3% is in "sc.surbl.org" > - 76.3% is in "sbl-xbl.spamhaus.org" (127.0.0.2) > - 82.3% is in either/both of those > - 2.4% were put "over the edge" because of those rules > The last percentage is a bit low due to running bigevil, > sa-blacklist.uri and quite a bunch of other rules. Thanks for sharing the stats! I hope to be able to increase the spam detection rates significantly for sc.surbl.org when I get back to coding.... ;-) Jeff C. -- Jeff Chan mailto:jeffc@surbl.org-nospam http://www.surbl.org/

1 0

Re: Please sanity check sa.surbl.org announcement
by Daniel Quinlan 12 Apr '04

12 Apr '04

Jeff Chan <jeffc(a)surbl.org> writes: > Dooh, I think I just realized you were asking whether multiple > RBLs could be supported from a single query inside SA, and not > whether we could combine the lists on the RBL side. Pardon my > misinterpretation if that was your original meaning. Yes, that is what I was asking. You could continue to support separate zones as well for people who want to mirror them. You seem to still have a tendency to reject ideas before reading them through. I'm not saying I've never made the same mistake, but this is getting old. -- Daniel Quinlan anti-spam (SpamAssassin), Linux, http://www.pathname.com/~quinlan/ and open source consulting

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss