We have a manual blacklist for the SC list that I use to nudge records without enough hits onto SC (sooner than they otherwise would):
http://spamcheck.freeapp.net/blacklist-domains
I've pruned that list, removing domain names that have had no NS records for three successive checks over about five weeks. That has reduced the manual blacklist list by about 270 records. Before removing those I checked to see how many DNS hits they were getting and only notinuse.biz had any of significance, so we kept that one on the manual blacklist.
SC will probably be manually pruned again some time in future, but the list (both automatic and manual) is so small and effective to begin with that it tends not to need to much manual maintenance.
Note that cleaning up the manual blacklist is not the same as whitelisting. Any record that comes off the manual blacklist can be manually or automatically blacklisted again in future at any time if it appears in spams again. So it's not at all a "free pass" to spammers or anything like that. It just means some domains that are unusable and don't appear in any recent spams are no longer included on SC for now. If they get used again, they'll get listed again.
I still plan to re-write the SC-specific engine and the general data engine used for processing the SURBL data. The main features will be more uniform processing of the data, including public logs of additions, deletions, whitelists, etc. Aside from SC, the results should be identical, and I will run them in parallel for a while to make sure that's the case. The SC data will be handle more efficiently and probably have an resolved-IP-based biasing system to get the domains of persistent spammers onto SC sooner, automatically.
Cheers,
Jeff C. -- "If it appears in hams, then don't list it."
Jeff Chan wrote:
[http://spamcheck.freeapp.net/blacklist-domains]
Note that cleaning up the manual blacklist is not the same as whitelisting. Any record that comes off the manual blacklist can be manually or automatically blacklisted again in future at any time if it appears in spams again. So it's not at all a "free pass" to spammers or anything like that.
If I understand it correctly what you have there is actually a "SC accelerator list", not really a blacklist. And the normal procedure to list SC "votes" in sc.surbl.org would work even with an empty "SC accelerator list".
It just means some domains that are unusable and don't appear in any recent spams are no longer included on SC for now. If they get used again, they'll get listed again.
You never get unusable SC "votes", if a domain is unusable SC cannot send a report, and if SC doesn't send a report, SURBL is not affected. Please correct me if I'm wrong.
IMHO it's more interesting to prune the WL based on SC "votes". The "accelerator list" is no problem, but it's a cute feature.
Bye, Frank
On Thursday, November 18, 2004, 6:49:26 AM, Frank Ellermann wrote:
Jeff Chan wrote:
[http://spamcheck.freeapp.net/blacklist-domains]
Note that cleaning up the manual blacklist is not the same as whitelisting. Any record that comes off the manual blacklist can be manually or automatically blacklisted again in future at any time if it appears in spams again. So it's not at all a "free pass" to spammers or anything like that.
If I understand it correctly what you have there is actually a "SC accelerator list", not really a blacklist.
Yes and no. If I add something to the manual blacklist, it gets listed within a few minutes if it wasn't already. It doesn't change any report counts; it forces any new records onto sc.
An accelerator list would perhaps lower thresholds, increase hit counts, etc. This is a simple "or"-type blacklist.
And the normal procedure to list SC "votes" in sc.surbl.org would work even with an empty "SC accelerator list".
Yes.
It just means some domains that are unusable and don't appear in any recent spams are no longer included on SC for now. If they get used again, they'll get listed again.
You never get unusable SC "votes", if a domain is unusable SC cannot send a report, and if SC doesn't send a report, SURBL is not affected. Please correct me if I'm wrong.
Correct, but there are other rare errors in SpamCop, such as when URIs or domains don't get extracted properly, usually due to obfuscation. If I see that happening with my personal SpamCop reports, and I'm sure the message is a spam, then I add the domain to the manual blacklist. Usually I try to mention the lack of detection to the SpamCop deputies also. I hope others do similarly.
The "accelerator list" is no problem, but it's a cute feature.
It's mainly meant to address too few reports, slow reporting, or processing errors.
P.S. I hope everyone is reporting fresh spams to SpamCop.
Jeff C. -- "If it appears in hams, then don't list it."
-
Frank Ellermann -
Jeff Chan