Discuss

discuss@lists.surbl.org

1862 discussions

[SURBL-Discuss] Michael Radwin blogs about closing Yahoo's redirectors
by Yusuf Goolamabbas 17 Jul '04

17 Jul '04

Yahoo! Engineer Michael Radwin blogs about Y! closing their redirector (not sure if all their country redirectors are closed) http://www.radwin.org/michael/blog/2004/07/open_http_redirectors.html

3 2

{Spam?} RE: SURBL Help?
by Henry Kwan 16 Jul '04

16 Jul '04

So I was having problems with the following whenever I lint'ed SA 2.63 after installing SURBL. >> >debug: uri tests: Done uriRE >> >Failed to compile URI SpamAssassin tests, skipping: >> >(syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule >> >SPAMCOP_URI_RBL, line 1, near "eval:" >> >syntax error at /etc/mail/spamassassin/bigevil.cf, rule >> >BigEvilList_23, line >> >1038, near "; >> >}" The problem was that even though the install copied all the files over to "/usr/lib/perl5/site_perl/5.8.3/Mail/SpamAssassin/" and the command "perl -MMail::SpamAssassin::PerMsgStatus -e 'print $INC{"Mail/SpamAssassin/PerMsgStatus.pm"},"\n"'" returned "/usr/lib/perl5/site_perl/5.8.3/Mail/SpamAssassin/PerMsgStatus.pm", my copy of SA 2.63 was actually using the pm files in "/usr/lib/perl5/site_perl/5.8.1/Mail/SpamAssassin/" instead. So once I copied over the pm files to the 5.8.1 directory instead, linting SA 2.63 was successful and I was getting the markups I expected. Though one minor problem still exists: debug: running uri tests; score so far=0 debug: uri tests: Done uriRE Use of uninitialized value in substitution (s///) at /usr/lib/perl5/site_perl/5.8.1/URI/Escape.pm line 161. Use of uninitialized value in substitution (s///) at /usr/lib/perl5/site_perl/5.8.1/URI/Escape.pm line 161. Use of uninitialized value in substitution (s///) at /usr/lib/perl5/site_perl/5.8.1/URI/Escape.pm line 161. debug: checking url: http://127.0.0.2/foo/foo debug: querying for 2.0.0.127.sc.surbl.org Are the uninitialized values anything to be concerned with? I have URI-1.31 installed. Thanks. --Henry

1 0

A sincere request for help
by William Stearns 16 Jul '04

16 Jul '04

Good afternoon, all, Through the tremendous efforts of so many contributors, the ws.surbl.org and its equivalent sa-blacklist have crossed 26,000 live (after the disabled and expired domains have been removed) domains. My _sincere_ thanks to everyone that has worked so hard to make this project work. There have been occasional questions about why the surbl's aren't scored higher. The answer is simple, and is based upon the one universal truth in spam characterization: "_Every_ technique used to identify spam _can screw up_." It's my sincere hope that the surbls, and my pet ws.surbl.org in particular, screw up less than most, but it's still true that they can cause false positives. I'm asking everyone that uses any surbls (that includes anyone using the sa-blacklist.cf, sa-blacklist.uri.cf, ws.surbl.org, *.surbl.org, spamassasin 3.0, and spamassassin 2.x with spamcopuri) for help. If you get any legitimate messages where one of the above mistakenly tagged the message as spam, _please_ let me know. I would sincerely appreciate it if you'd send the message to me as an attachment (forwards or bounces are OK too) with "blacklist" somewhere in the subject (this skips around my spam filters; I don't want the autowhitelist to start tagging _you_ as a spammer!). I'm asking for your help because false positives hurt all of us. I'd much rather have a blacklist with 3 domains I'm absolutely certain of than a blacklist with 120,000 iffy domains. Cheers, - Bill --------------------------------------------------------------------------- "Maybe is an Ambivalent Yet Beguiling Enigma" (Courtesy of Dale Harris <rodmur(a)maybe.org>) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

2 2

I want a contest too!! :p
by Chris Santerre 16 Jul '04

16 Jul '04

There are some very cool submissions here: http://wiki.apache.org/spamassassin/LogoContestEntries Can we have a contest for SARE and SURBL? Chris (I have no artistic talent!)

2 1

{Spam?} RE: SURBL Help?
by Chris Santerre 16 Jul '04

16 Jul '04

It will work. I'm not sure why everyone is getting these. I've looked at the code in there and the only thing that stands out is that all of those lines contain "http://surbl-org-permanent-test-point.com/foo/bar" So there may lie the problem? --Chris >-----Original Message----- >From: spam(a)mail.designmedia.com [mailto:spam@mail.designmedia.com] >Sent: Friday, July 16, 2004 1:14 PM >To: spamassassin-users(a)incubator.apache.org >Subject: SURBL Help? > > >Hi. Did anyone run into a open_redirect problem when >installing the SURBL >plugin? (See error log below) > >And if I try to install it anyway by copying over the .cf >file, SA spits out >this error when testing: > >debug: uri tests: Done uriRE >Failed to compile URI SpamAssassin tests, skipping: >(syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule >SPAMCOP_URI_RBL, line 1, near "eval:" >syntax error at /etc/mail/spamassassin/bigevil.cf, rule >BigEvilList_23, line >1038, near "; >}" > >I'm running Fedora C1 with SA 2.63 and all the prerequisite >perl modules. > >Thanks. > >---snip--- >(home/spam) mail 2%> perl Makefile.PL >Checking if your kit is complete... >Looks good >Writing Makefile for Mail::SpamAssassin::SpamCopURI >(home/spam) mail 3%> make >cp lib/Mail/SpamAssassin/Conf.pm blib/lib/Mail/SpamAssassin/Conf.pm >cp lib/Mail/SpamAssassin/PerMsgStatus.pm >blib/lib/Mail/SpamAssassin/PerMsgStatus.pm >cp lib/Mail/SpamAssassin/SpamCopURI.pm >blib/lib/Mail/SpamAssassin/SpamCopURI.pm >Manifying blib/man3/Mail::SpamAssassin::PerMsgStatus.3pm >Manifying blib/man3/Mail::SpamAssassin::Conf.3pm >Manifying blib/man3/Mail::SpamAssassin::SpamCopURI.3pm >(home/spam) mail 4%> make test >PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" >"test_harness(0, 'blib/lib', 'blib/arch')" t/*.t >t/blacklist........ok >t/dnsrbl...........ok >t/extract_urls.....ok >t/mailto...........ok >t/open_redirect....NOK 1# Failed test (t/open_redirect.t at line 37) >t/open_redirect....NOK 2# Failed test (t/open_redirect.t at line 44) >t/open_redirect....NOK 3# Failed test (t/open_redirect.t at line 52) >t/open_redirect....ok 4/5# Looks like you failed 3 tests of 5. >t/open_redirect....dubious >Test returned status 3 (wstat 768, 0x300) >Scalar found where operator expected at (eval 152) line 1, near "'int' >$__val" >(Missing operator before $__val?) >DIED. FAILED tests 1-3 >Failed 3/5 tests, 40.00% okay >t/spamcopuri.......ok >t/whitelist........ok >Failed Test Stat Wstat Total Fail Failed List of Failed >--------------------------------------------------------------- >---------------- >t/open_redirect.t 3 768 5 3 60.00% 1-3 >Failed 1/7 test scripts, 85.71% okay. 3/57 subtests failed, >94.74% okay. >make: *** [test_dynamic] Error 255 >(home/spam) mail 5%> >

2 2

makeurl.com
by Chris Santerre 16 Jul '04

16 Jul '04

looks like spammers are using this redir as well. (Thanks Dave) Time for another nicely written letter? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

1 0

Spamassassin 3 problems with SURBL
by Scott Truman 16 Jul '04

16 Jul '04

Hi, I am having trouble using the new URIDNSBL plugin. I have the following in my local.cf file: loadplugin Mail::SpamAssassin::Plugin::URIDNSBL score URIBL_WS_SURBL 3.0 score URIBL_SBL 3.0 (these are previously defined in 25_uribl.cf) but I seem to be getting no hits with them. Is this correct? Cheers Scott

2 1

RE: [SURBL-Discuss] Re: Using (SU)RBL with a browser, any way to do it? (was <snip> )
by Chris Santerre 15 Jul '04

15 Jul '04

>-----Original Message----- >From: Nicolas Riendeau [mailto:knightr@istop.com] >Sent: Tuesday, July 13, 2004 12:21 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Re: Using (SU)RBL with a browser, any way >to do it? (was <snip> ) > > >Chris Santerre wrote: > >> >> Or one could take the sa-blacklist file and turn it into a >quick hosts file. >> I have a host file on the server that is copied to everyones machine >> everytime they log in. Full of spyware domains that simply point to >> 127.0.0.1 and It is easy for me to change. >> >> However squid also rocks. I have had a test server running >for 1.5 years. I >> haven't had time to tweak it yet to go production yet. >> > >Hi Chris! > >I *assume* (I know what happens when you assume... (-; ) that >the host file is >not loaded in memory and is processed sequentially so wouldn't >having a big host >file make its parsing be very very slow? > >That's an assumption though... > Somewhat, but not too bad. Some people have had web completely turned off for failing to listen to me. 2 whole deparments have no web access now. Muahahahhahaha....I'm drunk with power! But yeah, I guess if you had 35k listings in host file it could be pretty slow :) Another reason to use squid. --Chris

4 3

{Spam?} Why is OrgDNS listed in SURBL ?
by Ralph Seichter 15 Jul '04

15 Jul '04

I wonder why www.orgdns.org ist listed in ab.surbl.org, sc.surbl.org and ws.surbl.org. OrgDNS offers dynamic name services and I just found an account activation notification flagged as spam by SpamAssassin, based on said SURBL listings. -- Mit freundlichen Grüßen / Yours sincerely Dipl. Inform. Ralph Seichter HORUS-IT Ahornweg 10 D-57635 Oberirsen Tel +49 2686 987880 Fax +49 2686 987889 http://horus-it.de/

4 7

Top Rule Hits on Pre2 in the last 16 hours (fwd)
by William Stearns 15 Jul '04

15 Jul '04

---------- Forwarded message ---------- Date: Wed, 14 Jul 2004 09:42:58 -0500 From: Dallas L. Engelken <dallase(a)nmgi.com> To: spamassassin-users(a)incubator.apache.org Subject: Top Rule Hits on Pre2 in the last 16 hours Just FYI, my pre2 results after upgrading yesterday. 5 of the 6 top hitters are URIBL! DCC, Razor and Pyzor still hanging in there at ~1%... And a big pat on the back to Bob (SARE ninja) for the LONGWORDS. Email: 55473 Autolearn: 9744 AvgScore: 3.82 AvgScanTime: 1.85 sec Spam: 16157 Autolearn: 8723 AvgScore: 12.77 AvgScanTime: 3.66 sec Ham: 39316 Autolearn: 1021 AvgScore: 0.14 AvgScanTime: 1.11 sec TOP SPAM RULES FIRED ------------------------------------------------------------ RANK RULE NAME COUNT PERCENT ------------------------------------------------------------ -> 1 URIBL_WS_SURBL 13057 5.36% -> 2 URIBL_SBL 12907 5.30% 3 HTML_MESSAGE 11136 4.57% -> 4 URIBL_SC_SURBL 11060 4.54% -> 5 URIBL_OB_SURBL 10728 4.40% -> 6 URIBL_AB_SURBL 7981 3.28% 7 LONGWORDS 7947 3.26% 8 MPART_ALT_DIFF 6186 2.54% 9 MIME_HTML_NO_CHARSET 5507 2.26% 10 FORGED_RCVD_HELO 5196 2.13% 11 MIME_MISSING_BOUNDARY 4987 2.05% 12 MIME_HTML_MOSTLY 4565 1.87% 13 INFO_TLD 4192 1.72% 14 NO_REAL_NAME 4102 1.68% 15 BIZ_TLD 3984 1.64% 16 MIME_HTML_ONLY 3717 1.53% 17 RCVD_IN_NJABL_DUL 3660 1.50% 18 HTML_20_30 3099 1.27% 19 DCC_CHECK 3018 1.24% 20 RAZOR2_CF_RANGE_51_100 2972 1.22% 21 RAZOR2_CHECK 2965 1.22% 22 AWL 2852 1.17% 23 HTML_FONT_BIG 2740 1.12% 24 DIGEST_MULTIPLE 2292 0.94% 25 PYZOR_CHECK 2262 0.93% 26 CLICK_BELOW 1919 0.79% 27 HTML_IMAGE_ONLY_12 1918 0.79% 28 HTML_30_40 1869 0.77% 29 LINES_OF_YELLING 1737 0.71% 30 HTML_LINK_CLICK_HERE 1591 0.65% 31 MIME_BOUND_DD_DIGITS 1583 0.65% 32 HTML_80_90 1566 0.64% 33 HTML_FONT_TINY 1549 0.64% 34 HTML_FONT_SIZE_TINY 1525 0.63% 35 HTML_70_80 1498 0.61% 36 MONEY_BACK 1301 0.53% 37 HTML_FONT_SIZE_LARGE 1255 0.52% 38 DRUGS_ERECTILE 1247 0.51% 39 SATIS_GUAR 1191 0.49% 40 MSGID_DOLLARS 1189 0.49% ------------------------------------------------------------

3 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss