on Tue, Aug 17, 2004 at 12:05:26AM -0700, Jeff Chan wrote:
On Monday, August 16, 2004, 10:01:07 PM, Steven Champeon wrote:
on Mon, Aug 16, 2004 at 09:47:02PM -0700, Jeff Chan wrote:
We need to keep the borderline cases and any domains and IPs with legitimate uses OFF the lists. We're having good success catching the hard core spammers. Everyone please remember that we need to bias the process towards keeping even partially legitimate entries off the lists.
Got any stats on how many times a domain has to be reported before it has a very low chance of being seen as a FP?
I don't have stats. IMO the first FP report is too many, and it probably means there are other similar FPs not being reported.
No, no - I mean, can we determine whether a domains is less likely to be considered an FP if multiple people report it? Therefore, scale according to the weight given the reports?
I know that probably sounds a little unreasonable, but I'd like to inculcate a shift in mindset when thinking about SURBLs.
We're not trying to block every last spam, only the pure, professional spammers. That's a very different mindset from the typical spam-fight, but absolutely necessary if we're going to have SURBLs widely used and adopted. We can't list entries that have legitimate uses.
Yes, I understand. That's why I haven't bothered to report delta.com, even though they're a bunch of incompetent spambags. But I also cannot take the time to maintain separate lists of domains - one for header blocking and another for body blocking - nor can I segregate my one list (now at ~139K domains) into two. So when I report, I'm almost always reporting domains I'm going to block either in the body or headers.
On the other hand, I /don't/ blacklist domains I think might show up in legit mail, anyway, even if I want to. My goal is to keep out the scumbags and reduce my FP rate on quarantined mail.