Discuss

discuss@lists.surbl.org

1 participants
1867 discussions

RE: [SURBL-Discuss] RFC: remove zone files from SURBL web site
by Chris Santerre 19 Jan '05

19 Jan '05

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Wednesday, January 19, 2005 6:06 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] RFC: remove zone files from SURBL web site > > >I'd like to get rid of the sc and ws bind and rbldnsd zone files >from the SURBL web site and replace them with a note asking >people to use rsync instead. Does anyone have any comments on >this? We don't want people grabbing the zone files from the web >site since rsync is so much more efficient. > >Probably I would check the web logs and try to contact some of >the folks trying this also. > Makes sense to me. And if they don't stop, then deny their IP. Which is what I'm about to do to all those people still trying to download rules that haven't been on my server in almost a year! --Chris

2 1

New surbl client: Yasu
by benjamin＠divingislife.net 19 Jan '05

19 Jan '05

Hi all, I'm glad to announce another client for surbl: Yasu It work on WIN32/W2K and intend primarly to work with clearswift Mailsweeper, but should work with any other mail system that can run external script and interpret return codes. It is Release under the GNU GPL licence. You can download it at: www.divingislife.net/yasu Enjoy and send me comment.

2 1

FW: Semi-OT: Spammer sues spam-report
by Chris Santerre 18 Jan '05

18 Jan '05

I thought this was worth forwarding, as you never know when one of our projects may fall under this kind of silly thing. Also want to keep a good eye out on the Discovery aspect of it all. What spammers don't realize is that with this suit, we can now find out more about them. --Chris >-----Original Message----- >From: Matthew Cline [mailto:matt@nightrealms.com] >Sent: Monday, January 17, 2005 2:01 PM >To: ML-spamassassin-talk >Subject: Semi-OT: Spammer sues spam-report > > >A spammer is suing someone who reported their spam for >"Tortuous Interference >with Contract" and "Defamation": > >> The defendant knew intentionally and improperly interfered with the >> performance of the said contract by inducing Lightship Telecom and >> Spectra Access, Inc., to terminate the contracts. > >... > >> The defenandt induced the termination by intentionally making >> misrepresentation about ATRIKS and Brian Haberstroh to the said >> third parties. > >It would be funny if it weren't for Jay Stuler having to pay >legal fees for >all this; Jay can seriously use donations to help fight this. >I find it >interesting that they aren't suing Spamhaus.org or Spews.org, >which also have >"misrepresentations" about the spammers; looks rather like a >SLAPP lawsuit to >me. > >Jay posted the following to USENET: > >From: Jay Stuler <usenetjunk2004(a)yahoo.com> >Newsgroups: news.admin.net-abuse.email >Subject: Atriks lawsuit update >Date: Sat, 15 Jan 2005 22:22:03 -0500 > >> Hello gentle NANAE readers... > >> I found out this week that they declined my motion to dismiss. Yes >> - even though I am not a citizen of New Hampshire, and I have never >> been there, or done business there, they still decided I can be sued >> there. So the next stage of the suit begins - discovery. Some >> interesting things should come of this stage... > >> Unfortunately, this will cost quite a bit of money - which I still >> don't have. I need more donations to go further. But if I am >> financially able to go further, I am sure that many interesting >> things about Haberstroh's operation will be unearthed, if you know >> what I mean. > >> My lawyer made it quite clear to Haberstroh's lawyer that he will >> never receive any money, even with a judgement. Nevertheless, >> Haberstroh wishes to continue with the suit, to make spammers seem >> like the good guys. > >> I am still taking donations through PayPal. Every little bit helps. >> If there is any extra left over at the end of this (for some reason) >> it will be proportionately returned to the donors. The site with >> information on the suit is still at: >> http://spamlawsuit.spamshield.org I will update the site with more >> information as it comes to me. > >> Also please pass this on to anyone who you may think be >> interested... > >> Thanks > >-- >Give a man a match, and he'll be warm for a minute, but set him on >fire, and he'll be warm for the rest of his life. > >Advanced SPAM filtering software: http://spamassassin.org >

2 1

RE: [SURBL-Discuss] Re: quick poll on SURBL hit %
by Chris Santerre 18 Jan '05

18 Jan '05

I'm replying to both as I don't know if Terry is on the list..... >-----Original Message----- >From: Terry Sullivan [mailto:terry@pantos.org] >Sent: Monday, January 10, 2005 11:55 AM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] Re: quick poll on SURBL hit % > > >Chris Santerre wrote: > >>Just curious as to what average percent of spam people see SURBL >>hitting. In a non scientific manor, I average about 85% ... > >I've run multiple analyses on historical datasets, and get a >consistent >*average* of 82%-86%, so 84% is a decent estimate. > >The most noteworthy statistical characteristic of the SURBL hit rate >over time is the large *variance* in hit rate. Some days, the >SURBL hit >rate I observe in my data is in the 60%'s, while other days its in the >90%'s. The fluctuation appears to be at least somewhat periodic in >nature (several "low" days in a row, followed by several >"high" days). >I've not actually run the numbers, but my totally informal, >*purely gut* >sense is that the magnitude of that variance may have >diminished lately, >but the periodic pattern persists. These periodic fluctuations imply >that there is probably some systematic cause underlying this variance, >and that cause is itself almost certainly periodic in nature. That is interesting! I wonder if this has become a Metric for actual spam traffic? Could it coincide with weekends? Don't suppose you could graph that data over a 365 day period? > >>I have a feeling if I clean up my >>results a bit, that number would be even higher. > >I've talked about this with Jeff several times, and he's even shared >some of my comments with this list. No one in the anti-spam >world likes >hearing this, but there is very strong evidence of a "hard" >statistical >detection limit right around ~85%. This limit appears to be more or >less independent of data set or detection method. Actually Jeff and I have discussed this, and I finally understood it :) I also agree with the 85% rule of yours. And we seem to be hitting it very nicely! I'm not sure Bayes even hits that close to 85%! --Chris

1 0

RE: [SURBL-Discuss] New surbl client: Yasu
by Chris Santerre 18 Jan '05

18 Jan '05

>-----Original Message----- >From: benjamin(a)divingislife.net [mailto:benjamin@divingislife.net] >Sent: Tuesday, January 18, 2005 10:55 AM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] New surbl client: Yasu > > > >Hi all, > >I'm glad to announce another client for surbl: Yasu >It work on WIN32/W2K and intend primarly to work with >clearswift Mailsweeper, but should work >with any other mail system that can run external script and >interpret return codes. > >It is Release under the GNU GPL licence. > >You can download it at: >www.divingislife.net/yasu > >Enjoy and send me comment. > Nice. My first question is, does it have a local 'skip list' for the most noted domain names? Like google.com, yahoo.com. ect... It is pretty important to reduce traffic. --Chris

1 0

linkshield - Premium affiliate link protection
by Alex Broens 15 Jan '05

15 Jan '05

Guys, Getting spams with links to: http://secure. linkshield. com/?c=401&l=12 Seems this so called "Premium affiliate link protection" is being "abused". quite a few dicey nanas and "biz" & "mlm" newsgroup entries. They've been around for a while, but I really doubt if, in this case, that should be take in account. Comments? votes to SURBLize? Alex

2 1

Re: quick poll on SURBL hit %
by Terry Sullivan 10 Jan '05

10 Jan '05

Chris Santerre wrote: >Just curious as to what average percent of spam people see SURBL >hitting. In a non scientific manor, I average about 85% ... I've run multiple analyses on historical datasets, and get a consistent *average* of 82%-86%, so 84% is a decent estimate. The most noteworthy statistical characteristic of the SURBL hit rate over time is the large *variance* in hit rate. Some days, the SURBL hit rate I observe in my data is in the 60%'s, while other days its in the 90%'s. The fluctuation appears to be at least somewhat periodic in nature (several "low" days in a row, followed by several "high" days). I've not actually run the numbers, but my totally informal, *purely gut* sense is that the magnitude of that variance may have diminished lately, but the periodic pattern persists. These periodic fluctuations imply that there is probably some systematic cause underlying this variance, and that cause is itself almost certainly periodic in nature. >I have a feeling if I clean up my >results a bit, that number would be even higher. I've talked about this with Jeff several times, and he's even shared some of my comments with this list. No one in the anti-spam world likes hearing this, but there is very strong evidence of a "hard" statistical detection limit right around ~85%. This limit appears to be more or less independent of data set or detection method. This is not to say that only 85% of spam can be stopped; rather, it implies that no one *single* detection method broadly applicable to spam-as-a-whole can reliably (repeatably, predictably, consistently) snag more than ~85%. (At the risk of sounding testy, I am *not* looking to debate this point. Under the heading of "you can lead a horse to water," I'm content to have anyone to believe anything they like, even if it's demonstrably wrong. All I can do is report empirical results based on multiple analyses, multiple detection methods, multiple datasets, and multiple time periods. The observed ~85% detection limit is remarkably consistent across all these conditions.) One of the vaguely interesting research questions implicit in this result is the determination of the *unique* contribution of any given approach. That is, what %-age of spam *missed by all other approaches* does a particular detection method snag? On my *personal* spam corpus, SURBL's *unique* contribution is in the 18%-20% range.

1 0

using multi list as rhsbl
by Matt Egan (hotmail) 09 Jan '05

09 Jan '05

I was just curious if anyone had tried to use any of the surbl.org zones as an rhsbl at the mta level. I just turned it on in "warn only" mode on my postfix box. I did it on both the sender (mail from) and the client (ptr if available). just curious if anyone else had tried or does this. -Matt

2 1

securedata.net FP report
by Vincent Schonau 07 Jan '05

07 Jan '05

One of our users has reported a false positive on id294.securedata.net; securedata.net is listed in ws. I see no sightings more recent than june 2004; and none for this specific subdomain. The domain appears to belong to some sort of shopping-cart service-provider, but I'm unsure who (hostway?). They appear to assign distinct subdomains to distinct customers. What's the policy on this type of thing? To supply a full message I'll have to ask the customer for permission. I'd rather not send it to a publicly archived mailing list, however (customer data 'n all). Regards, -- Vincent Schonau XS4ALL Internet BV http://www.xs4all.nl/veiligheid/ Nieuwe spamfilters! http://www.xs4all.nl/nieuws/bericht.php?id=593

3 3

Re: [SURBL-Discuss] securedata.net FP report
by Jeff Chan 06 Jan '05

06 Jan '05

On Thursday, January 6, 2005, 5:28:18 AM, Alex Broens wrote: > Jeff, > It would be very appreciated if you would make new whitelisted URIs > public so those who run local zones can decide if the want to move a URL > to their private zone Hi Alex, The SURBL whitelist is available at: http://spamcheck.freeapp.net/whitelist-domains.sort Jeff C. -- "If it appears in hams, then don't list it."

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss