At 01:38 2005-04-22 -0700, Jeff Chan wrote:
[forwarded with Paul's permission. Please comment.]
I don't know the current method used to decide when to add domainsto your new list, and I definitely see *much* smaller levels of spam than many others on the various mailing lists.
It's the top 97th percentile of hits, which only gets about a hundred more new records (domains and IPs) than we already have in SURBLs. We can crank that up later when we get the FP issues nailed down better, though improved processing techniques.
However, my own experience, so far, is that absolutely no "zero-hour" spams have been caught,
Yes, that's because the new URI hit counts must overcome the mass of earlier reports. There may be smarter ways to organize this, but simply lowering the threshold of inclusion (e.g., going to the 98th percentile) would get more on the list sooner.
but very many Spamcop reports (about 1/2 hour later) do trigger; So I have to agree with the
few who
have suggested a much more aggressive decision about when to add.
Yes, I agree too. :-) When I announced the list for testing I said we'd start conservative to get a feeling for the data.
Could we maybe, just for testing, have two or more lists to test with different percentiles? 97.xs.surbl.org 98.xs.surbl.org etc...
Patrik