Discuss

discuss@lists.surbl.org

1867 discussions

[SURBL-Discuss] checking plain domains in message bodies against SURBLs reportedly effective
by Jeff Chan 04 Sep '04

04 Sep '04

Randy Brukardt of rrsoftware.com mentioned that checking plain domains occurring in message bodies against SURBLs was pretty productive. (E.g., look for domain.com in addition to www.domain.com or http://www.domain.com). Perhaps this could be something interesting to at least try experimentally or to think about. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

3 5

"safelists"
by Joe Wein 04 Sep '04

04 Sep '04

Today I processed a pile of 11,000 spams donated by Raymond, as I'm gradually gearing up for large-scale spamtrap processing. I ended up with many most obvious spam domains, but an even bigger pile of domains that aren't quite as suspicious. Many are from last year and the name server is not listed by SBL. I don't want to add any grey domains to a black pile. While investigating many of them to determine if they deserved listing, I repeatedly came across the term "safelist". They seem to be some kind of opt-in lists. What is the term supposed to mean exactly? Joe -- http://www.joewein.de/sw/jwSpamSpy/

2 1

Re: [SURBL-Announce] PROBLEM: WS.SURBL.ORG frozen
by Jeff Chan 04 Sep '04

04 Sep '04

On Friday, September 3, 2004, 3:10:29 PM, Raymond Dijkxhoorn wrote: > Currently we are running with a somehow frozen ws.surbl.org list. We are > experiencing hardware trouble with one of the SURBL machines. New updates > will be processed, but most likely activated after we restore full > functionality. > The main SURBL site is not afffected, its only related to the WS updates. > We are working hard to get the processing box back online. We made a temporary workaround to get updates from Raymond and others directly into ws.surbl.org until the other server comes back. Once the other server is working again we will undo that workaround. So ws is now getting updated with at least some of the new data. Jeff C.

2 1

whitelist: cooleremail.com and icebase.net?
by Jeff Chan 04 Sep '04

04 Sep '04

cooleremail.com is apparently on WS and asking to be whitelisted. Does anyone know anything about them or why they are on WS? They seem to have reasonable antispam policies: http://www.cooleremail.com/aboutus_spam.shtml Jeff C.

3 6

Perfect example!
by Chris Santerre 04 Sep '04

04 Sep '04

tourisme-montreal.org Just sent a spam to our president. However it has legit uses. Screw them! Here is a nice fresh one for UC :) --Chris

3 4

RFC: Public false positve reporting form
by Jeff Chan 04 Sep '04

04 Sep '04

How does anyone feel about a public false positive reporting form? Such a form would include the reporting party, the domain(s) or IPs, reasons why it's a false positive, etc. It could be processed publically or privately in a bug tracking system. It would be hand checked by some of our experienced spam fighters. The results could be published or simply aggregated without public announcement into the overall whitelist. Is this a good or bad idea? What level of publication should there be? What forms of proof (if any) does anyone like? Other comments? Jeff C.

4 4

RE: [SURBL-Discuss] Proposing a greylist
by Chris Santerre 03 Sep '04

03 Sep '04

It has been moved off list. See Ryan's post. If you would like to be involved, contact him. --Chris (wishes this thread to go away now.) >-----Original Message----- >From: Bret Miller [mailto:bret.miller@wcg.org] >Sent: Friday, September 03, 2004 5:00 PM >To: SURBL Discussion list >Subject: RE: [SURBL-Discuss] Proposing a greylist > > >To further this idea, comparing it to DNSBLs is appropriate. >There are a >lot of DSNBLs you can use. Many agree that sbl-xbl spamhaus lists are >high quality with no (or almost no) false positives. For that reason, a >lot of us use them to block e-mail. > >Bl.spamcop.net is another DNSBL, and while it's a fine list, >the FP rate >is much too high for me to block e-mail on it alone. However, it's >highly useful in SpamAssassin, putting many messages over the >spam score >threshold. > >While the SURBL staff has decided that they would rather not "divide >their efforts" to support a project like this, it certainly >doesn't mean >that it shouldn't be done be someone else. At that point, the staff is >right to ask that the discussion about its details be moved off this >list. Perhaps the better place to discuss this is the SA >general list as >they are more open to just about any new project that helps SA detect >spam accurately. > >I know if I relied totally on any one method of filtering >spam, a lot of >spam would be getting through that isn't. It's because the >comination of >content and structure analysis with bayesian analysis DNSBL and URIBL >all contributes to the end result. > >Bret > > > > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

1 0

Proposing a greylist
by Chris Santerre 03 Sep '04

03 Sep '04

I am officially proposing a greylist surbl. We are going to see more and more of this stuff. We might as well deal with it now. I'm suggesting a greylist for all spammers that ride that line. Like the euniverse junk we have been talking about. 1)We DO NOT include it in multi. 2)We SCREAM to the world that it WILL hit some legit, and that only hard liners should use. 3)We DON'T remove domains unless they go completely black, or have no NANAS hits for 3-4 months. 4)See number 2 again. 5)We tell people it is completely optional and to see number 2. I predict it would be used more for personal emails. IT also gives us an in between mechanism. Rather then list or no list. We get a grey list we desperately need. THoughts? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

12 31

RE: RE: [SURBL-Discuss] "Unconfirmed" list proof-of-concept
by Chris Santerre 03 Sep '04

03 Sep '04

>-----Original Message----- >From: Rob McEwen [mailto:rob@powerviewsystems.com] >Sent: Friday, September 03, 2004 4:04 PM >To: SURBL Discussion list >Subject: Re: RE: [SURBL-Discuss] "Unconfirmed" list proof-of-concept > > >Chris and Ryan... > >I think that ya'll are making a mistake... please reconsider >the advice I gave in my last two e-mails (did you read them?). > >Basically, you would have gotten just about everything you >ever wanted by following my advice (not the Spamhaus part... >but, rather the tracking part) and it would all then be done >with official SURBL-participation and blessings... (did you >yawn during the SpamHaus part of my message and ignore the >rest?)... of course, this assumes that Jeff will warm up to my >suggestion in the first place?? > >But, if your way is inevitable, I just might join you... just >please reconsider in the meantime... and wait to see what >Jeff's final word is on this matter. > Jeff has given his final word on this. Was pretty clear :) And I respect Jeff's wishes. This really isn't that big of a deal. Its going to be completely private until a good data set is made, then made availible for testing by SURBL members if they want it. Just another list, that won't be attached to the SURBL name. Discussions won't be carried out in the SURBL list. Of course if in normal SURBL traffic we find a domain unfit for blacklisting, we may see fit to add to UC. Otherwise for now it will seem like this discusion never took place :) --Chris (You saw nothing.)

1 0

RE: [SURBL-Discuss] "Unconfirmed" list proof-of-concept
by Chris Santerre 03 Sep '04

03 Sep '04

LOL yeah I already sent him an email saying to let us know when it is back up. I'm sure he is ready for an ice cold brew! --Chris (Top posting for fun and profit!) >-----Original Message----- >From: Alex Broens [mailto:surbl@alexb.ch] >Sent: Friday, September 03, 2004 4:03 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] "Unconfirmed" list proof-of-concept > > >Chris Santerre wrote: >> Look mom! I have another project! :) >> >> I think I'll start an Apache project that attempts to >combine other Apache >> projects! Woot! > >and here's another: You tell me what to do with all those nice >ZeroHour >URIS I'm collecting while poor Bill is sweating? > >Fosters time... > >Alex >

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss