On Tue, 20 Apr 2004, Jeff Chan wrote:
On Tuesday, April 20, 2004, 7:12:25 PM, Scott Truman wrote:
On Tuesday, April 20, 2004, 6:10:30 PM, Bill Landry wrote:
127.0.0.2 = Spamcop 127.0.0.3 = WS List 127.0.0.4 = BigEvil List 127.0.0.5 = etc...
Same thing multi-test RBLs like AHBL, Sorbs, Blars,
FiveTen, NJABL and
others do.
One could even extend that as such (if they don't already):
127.0.0.2 = SC List 127.0.0.4 = WS List 127.0.0.8 = BigEvil List 127.0.0.16 = Someother List etc....
Multiple hits for the same lookup could be returned by combining the last octet i.e. a result of 127.0.0.10 would indicate the URI was found in both the SC and BigEvil lists. If one was only interested in what SC found, then one would AND the result with 127.0.0.2
Nice. We probably will do an "all" list, so this is good to think about.
Does anyone have any comments about either approach? Bill seems to indicate there was a precedent in other "combining" RBLs, but Scott's suggestion is also clever.
Both two encodings are used by other DSBLs. The first one is an enumeration (used by Sorbs, NJABL, etc), the second one a bit-field ("set") (used by MAPS RBL+).
The enumeration has the advantage of being simpler and covering more posibilities but is only single valued. (IE the match is for only one possible list).
The bit-field has the advantage of being able to represent membership in multiple lists at the cost of represinting fewer lists (7 as opposed to 254 possible groups). IE you can say that a particular entry is in both SC list & WS list.
SA already has functions for picking apart either kind of representation.
Given the nature of the proposed blackist (IE a compilation of different sources of information), I'd suggest the bit-field format to best handle the case of a given host being in more than one list.