-----Original Message----- From: Jeff Chan [mailto:jeffc@surbl.org] Sent: Monday, October 25, 2004 3:08 PM To: SURBL Discuss Subject: Re: [SURBL-Discuss] free host: greatnow.com
On Monday, October 25, 2004, 8:18:34 AM, Chris Santerre wrote:
Fine. Removed. A known blog spammer host gets one FP and we
remove then all.
Done.
Chris, Instead of withdrawing the list can you give us a chance to review it?
Chris, If you put the file back up with a non-used name, I can turn it into a test SURBL for people to try. After testing and debugging we could look at adding it to a list. The broader the testing, the better the results.
I usually put up new lists for people to test as widely as possible before turning them live.
No need. Moved to UC list.
Might it be better to set up the blog spam domains as a separate list inside multi, but testing them first? We would still want to find a way to minimize collateral damage and keep otherwise legitimate domains off a blog list.
Legitimate domains like greatnow.com?
http://www.blackjack.greatnow.com http://www.viaga-viagra.greatnow.com http://www.debtconsolidation.greatnow.com http://generic-cialis.greatnow.com http://www.ed.greatnow.com/ http://www.bulk-email.greatnow.com http://www.bonds.greatnow.com http://www.1-dating.greatnow.com http://www.credit-card.greatnow.com http://www.car-insurance.greatnow.com
We got the UC list covered. It isn't in the SURBL group. You don't have to worry about it.
--Chris
On Monday, October 25, 2004, 12:55:07 PM, Chris Santerre wrote:
From: Jeff Chan [mailto:jeffc@surbl.org]
Might it be better to set up the blog spam domains as a separate list inside multi, but testing them first? We would still want to find a way to minimize collateral damage and keep otherwise legitimate domains off a blog list.
Legitimate domains like greatnow.com?
http://www.blackjack.greatnow.com http://www.viaga-viagra.greatnow.com http://www.debtconsolidation.greatnow.com http://generic-cialis.greatnow.com http://www.ed.greatnow.com/ http://www.bulk-email.greatnow.com http://www.bonds.greatnow.com http://www.1-dating.greatnow.com http://www.credit-card.greatnow.com http://www.car-insurance.greatnow.com
Probably every free hosting site has abuse, but most have far more legitimate uses than abusive ones. greatnow may be an exception. I did find a ton of blog spam for it on google, as you suggested. The real question is how much legitimate use they have. I did apparently find some, but it doesn't mean they're a whitehat. They could be a blackhat with a few incidental or unintentional legitimate users. :-(
The question deserves some research. The reason I brought them up is because some had an apparent legitimate use for greatnow.com. That's usually a reason to not list them.
We got the UC list covered. It isn't in the SURBL group. You don't have to worry about it.
--Chris
If we're thinking about setting up a blog list (as we were earlier), then it might be useful to test the data before using it, don't you agree?
I don't see how dumping lists with arbitrary FPs onto UC helps either UC or SURBLs. In fact it's one of the bad things we predicted: that a grey list would become a dumping ground with some FPs and some domains that belong on a blocklist, all sitting there underclassified, unchecked or ignored.
It's better to do things openly and let people check new data sources together.
Jeff C. -- "If it appears in hams, then don't list it."
Jeff Chan wrote to SURBL Discuss:
I don't see how dumping lists with arbitrary FPs onto UC helps either UC or SURBLs. In fact it's one of the bad things we predicted: that a grey list would become a dumping ground with some FPs and some domains that belong on a blocklist, all sitting there underclassified, unchecked or ignored.
It's better to do things openly and let people check new data sources together.
Hi Jeff,
If you'd like to publicly accuse the UC effort of doing "bad things" or listing "arbitrary FPs", please educate yourself on the policies of UC. They are publicly listed at http://uc.sasknow.com/criteria.shtml, and they're being actively developed through discussion on the UC mailing list, which is an open list to which anyone can subscribe and participate. In particular, one will note that all domains are hand checked before being added, and that domains suitable for blocklists like SURBL do not belong in UC.
I'm sure people value your opinions. So, please refrain from making baseless statements about a public effort it seems you know very little about.
Understood?
- Ryan
On Monday, October 25, 2004, 3:39:49 PM, Ryan Thompson wrote:
They are publicly listed at http://uc.sasknow.com/criteria.shtml, and they're being actively developed through discussion on the UC mailing list, which is an open list to which anyone can subscribe and participate. In particular, one will note that all domains are hand checked before being added, and that domains suitable for blocklists like SURBL do not belong in UC.
What prompted my concerns is that the blogger list which Chris had in WS earlier may have had some FPs, at least from the SURBL point of view.
Jeff C. -- "If it appears in hams, then don't list it."
I don't see how dumping lists with arbitrary FPs onto UC helps either UC or SURBLs. In fact it's one of the bad things we predicted: that a grey list would become a dumping ground with some FPs and some domains that belong on a blocklist, all sitting there underclassified, unchecked or ignored.
Actually, the point of the UC list isn't that domains are "underclassified, unchecked or ignored". It's simply that like other spam indicators, some domains indicate the message *may* be spam and there's a lot of room in *may* to include a list that doesn't hit *only* on spam.
That type of list needs to be separate and scored lower than a list that hits only spam. But it's still necessary-- at least some of us feel that way.
Your rule that a domain may not ever hit in any ham means that a domain that hits 99.9% of the time on spam and 0.1% in ham may never be listed when, in fact, it's still a good indicator that the message may be spam.
Having a URIBL that hits some ham means that I may, as with other rules, have to whitelist more senders. OTOH, not having one means that users will receive more spam, which is complained about far more here than FPs.
Bret
On Monday, October 25, 2004, 3:46:58 PM, Bret Miller wrote:
Having a URIBL that hits some ham means that I may, as with other rules, have to whitelist more senders. OTOH, not having one means that users will receive more spam, which is complained about far more here than FPs.
The problem with FPs is that they may prevent a message from ever arriving. Absent a telephone call or some other communication, a falsely blocked legitimate message may never get discovered. FPs are far more damaging than false negatives (spam that gets through undetected). Therefore it's much better to get a little spam than to get legitimate messages blocked.
Jeff C. -- "If it appears in hams, then don't list it."
on Mon, Oct 25, 2004 at 04:40:07PM -0700, Jeff Chan wrote:
On Monday, October 25, 2004, 3:46:58 PM, Bret Miller wrote:
Having a URIBL that hits some ham means that I may, as with other rules, have to whitelist more senders. OTOH, not having one means that users will receive more spam, which is complained about far more here than FPs.
The problem with FPs is that they may prevent a message from ever arriving. Absent a telephone call or some other communication, a falsely blocked legitimate message may never get discovered. FPs are far more damaging than false negatives (spam that gets through undetected). Therefore it's much better to get a little spam than to get legitimate messages blocked.
My goal is to eliminate spam. Part of my strategy involves quarantining. BLs such as UC allow me to quarantine "possible spam" through scoring or other mechanisms. Don't blame the DNSBL if people use a quarantine-only list for delivery-time rejection.
Steven Champeon wrote to SURBL Discuss:
Don't blame the DNSBL if people use a quarantine-only list for delivery-time rejection.
Yeah. Kinda like outlawing piano wire because it can potentially appear in someone's jugular. :-)
- Ryan
----- Original Message ----- From: "Steven Champeon" schampeo@hesketh.com To: "SURBL Discuss" discuss@lists.surbl.org Sent: Monday, October 25, 2004 7:58 PM Subject: Re: [SURBL-Discuss] free host: greatnow.com
My goal is to eliminate spam. Part of my strategy involves quarantining. BLs such as UC allow me to quarantine "possible spam" through scoring or other mechanisms. Don't blame the DNSBL if people use a quarantine-only list for delivery-time rejection.
As long as your intent is clearly stated on your homepage that is fine. Just make sure the people know of the slightest risk if they choose to block outright.
Jeff Chan wrote to SURBL Discuss:
On Monday, October 25, 2004, 3:46:58 PM, Bret Miller wrote:
Having a URIBL that hits some ham means that I may, as with other rules, have to whitelist more senders. OTOH, not having one means that users will receive more spam, which is complained about far more here than FPs.
The problem with FPs is that they may prevent a message from ever arriving. Absent a telephone call or some other communication, a falsely blocked legitimate message may never get discovered. FPs are far more damaging than false negatives (spam that gets through undetected). Therefore it's much better to get a little spam than to get legitimate messages blocked.
Jeff, are you trolling on your own mailing list? :-)
You're still speaking (and possibly thinking) in terms of outright blocklists, which is what SURBL is designed to be. UC, contrarily, is designed be used as a spam indicator, in conjunction with other spam and ham indicators in classifiers like SpamAssassin. I really don't think I need to explain how this works, nor need I validate its usefulness.
Feel free to join uc-discuss (info on http://uc.sasknow.com/) if you'd like to get a better idea of what we're up to, or even chime in.
- Ryan
On Monday, October 25, 2004, 6:01:54 PM, Ryan Thompson wrote:
You're still speaking (and possibly thinking) in terms of outright blocklists, which is what SURBL is designed to be.
Yes, I was referring to why SURBLs should not have FPs.
Jeff C. -- "If it appears in hams, then don't list it."
-
Bret Miller -
Chris Santerre -
Fred -
Jeff Chan -
Ryan Thompson -
Steven Champeon