Discuss

discuss@lists.surbl.org

1862 discussions

Re: [SURBL-Discuss] What to tell senders
by Jeff Chan 12 Sep '06

12 Sep '06

On Tuesday, September 12, 2006, 7:09:14 AM, Joseph Brennan wrote: > Regarding rejection, I realize I just popped up on this list without > intro. Columbia University's mail system refuses about 1 million > messages a day based on Spamhaus, NJABL, DNSBL, high Spamassassin > score, and rules written in Mimedefang. SURBL looks like a good > addition to our arsenal. Sounds reasonable. :-) > Logging in test yesterday and overnight suggests that SURBL will > catch 50,000 messages a day that are not already caught before > Spamassassin (which we run last). That's very worthwhile. Great! Sounds like it should help. BTW an excellent way for everyone to help the SURBL project is to send us actual FPs at our "whitelist at" address. It's ok to mention a domain you don't own, if we know you. Full info is not needed, but some general context such as opt-in status, reasons the domain is legitimate, etc., are very helpful and should be included if possible. Hopefully the FPs will be few and far between. Cheers, Jeff C. -- Don't harm innocent bystanders.

1 0

What to tell senders
by Joseph Brennan 12 Sep '06

12 Sep '06

When we reject a message because it contains a URI that is in SURBL, should our 550 message refer the sender to www.surbl.org? The surbl web pages seem to be addressed to mail system administrators rather than general email users. I'm asking partly so that we don't raise the support load on the surbl folks when we start rejecting. Of course there should be near zero instances of ordinary people ever seeing the reject message, making this a moot question. Is any other system directing senders to www.surbl.org? Joseph Brennan Columbia University Information Technology

3 3

Re: [SURBL-Discuss] What to tell senders
by Rob McEwen (PowerView Systems) 11 Sep '06

11 Sep '06

Joseph Brennan asked: > When we reject a message because it contains a URI that is in SURBL, > should our 550 message refer the sender to www.surbl.org? The surbl Joseph: I can't speak officially for SURBL, but I'd suggest stating something like the following in the SMTP return text: "blocked by XXX due to containing a URI listed at www.surbl.org" where "XXX" = your organization or your spam filter. The idea is that we WANT legit senders to give SURBL immediate feedback if/when SURBL makes a mistake (which is very rare). However, SURBL never blocks any mail and we don't want to give users the mistaken impression that SURBL blocked their message. Instead, it is the spam filter provider or mail hosting provider's decision to use SURBL and SURBL's lists comes without warranty or any type of guarantees (even those most deem SURBL to be very accurate and to have extremely few FPs). BTW - just a side suggestion... I find that the best spam filters employ a variety of spam-catching techniques and strive to NOT score any one particular tactic high enough to single-handedly block a message. Of course, we strive to make SURBL so reliable that most would consider it safe to block a message soley based on SURBL "hit"... but, if applied correctly, following this suggestion will provide the best case scenario in BOTH reducing FPs and boosting spam filtering percentages. Rob McEwen PowerView Systems rob(a)PowerViewSystems.com

1 0

RE: Inetesting new URI ploy
by Chris Santerre 11 Sep '06

11 Sep '06

> -----Original Message----- > From: Bill Landry [mailto:billl@pointshare.com] > Sent: Monday, September 11, 2006 2:55 PM > To: users(a)spamassassin.apache.org; discuss(a)lists.surbl.org > Subject: Inetesting new URI ploy > > > Just came across one of these in a spam message: > > bang Locals @ www.nowdatenow. com oopsy no space before com > > Oh what will they try next...? They will take a page from google... Please figure this out and type in your browser for sup3r l33t drgzzzz! http://haacked.com/images/googlebillboard.jpg --Chris

1 0

Inetesting new URI ploy
by Bill Landry 11 Sep '06

11 Sep '06

Just came across one of these in a spam message: bang Locals @ www.nowdatenow. com oopsy no space before com Oh what will they try next...? Bill

1 0

Re: [SURBL-Announce] surblhost is a C command line program to query SURBLs
by Jose Marcio Martins da Cruz 18 Aug '06

18 Aug '06

Hi, Jeff Chan wrote: > Christian Stigen Larsen reports: > > "I've made a simple C commandline program to query multi.surbl.org > > I'd be very happy to receive comments. The program is available > from http://surblhost.sourceforge.net (source only)." I'm sending a little patch attached (configure.ac). It's needed to correct three small things : - under solaris, this program shall also be linked against libnsl and libsocket - you've hardcoded CFLAGS and LDFLAGS (-Wall) specific to gcc compiler. So, your program can't be build using other compilers. These flags are usually used as environnement variables. Things like : env CFLAGS="-Wall" ./configure - functions shall be checked after libraries, as some of them depend on libraries. E.g., on my system, your configure script couldn't detect the existence of gethostbyname as this function is defined at libresolv, and as configure hadn't yet checked the library, the function wasn't found. About the program itself, you hardcoded tlds and whitelists inside your program. So, if these lists change, your program shall be recompiled. IMHO, it's better to put them in some place (/usr/local/share/...). The other comment regards the programming language. I program most things I need in C, and I digged into your source - it's well coded. But, IMHO, this is a kind of program easier to do in perl, mainly in the way you want to handle input parameters and print results. And... it's a nice tool - thanks. Jose-Marcio -- --------------------------------------------------------------- Jose Marcio MARTINS DA CRUZ Tel. :(33) 01.40.51.93.41 Ecole des Mines de Paris http://j-chkmail.ensmp.fr 60, bd Saint Michel http://www.ensmp.fr/~martins 75272 - PARIS CEDEX 06 mailto:Jose-Marcio.Martins@ensmp.fr

2 2

Logo competition
by Jeff Chan 18 Aug '06

18 Aug '06

Do we have any artists here, or access to artists who would like to try to design a logo for the SURBL project? Jeff C. -- Don't harm innocent bystanders.

2 5

Java SURBL client
by Jörg Zieren 16 Aug '06

16 Aug '06

Dear all, this may be of interest to some: The current version of Camel's Eye, a GPL'd client-side Java POP3/SMTP proxy, has support for SURBL (and others). More info is available on http://zieren.de/ce -Jörg -- Jörg Zieren http://www.zieren.de +49 170 7516134 For a list of common abbreviations, see http://www.zieren.de/abk.html Please do not communicate my address to *any* website/service/company

1 0

Program comments: surblhost
by Christian Stigen Larsen 16 Aug '06

16 Aug '06

Hi, I've made a simple C commandline program to query multi.surbl.org I'd be very happy to receive comments. The program is available from http://surblhost.sourceforge.net (source only). Thanks! -- Christian Stigen Larsen, http://csl.sublevel3.org

2 3

Re: Spam in progress bit ...
by opencomputing＠gmail.com 11 Aug '06

11 Aug '06

>>The idea was that data mining in surbl logs (or other RBL / URI services >>by a large number of servers) might enhance accuracy by allowing >>accurate realtime detection of spams in progress. I might be wrong, or >>maybe it's not surbl's role to do such analysis. >> >> > >We allready do.... > > Does that mean that you use this query patterns for a particular URI to delist it, if it is never queried too often from geographically diverse IPs? Or something similar? Also, do you use the site/URI related info like its contents, how often the SSL gets changed, info like whether the site SSL pretends to be for paypal.com while signed by some russian authority or korean one etc? I assume at least the PH list uses this criteria. Using this technique for other lists also could help to find whether the URI is spammy. -- cheers, Skar.

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss