[SURBL-Announce] Like sc.surbl.org,
ws.surbl.org works with any SURBL-compatible programs
Jeff Chan
jeffc at surbl.org
Sun Oct 31 14:11:37 CET 2004
A question about whether SpamCopURI would support using the
alternative SURBL ws.surbl.org came up, so I thought I'd address
that for everyone. Any program that knows how to extract URIs
from message bodies, then domains from the URIs, then compare
those domains against an RBL can use any or all of the SURBL
lists. Therefore SpamCopURI will work with ws.surbl.org just
fine. (Noting of course that the ws results won't necessarily
be related to the SpamCop-derived data in the sc list.)
All you need to do is add a rule with the name of that list:
uri SA_URI_RBL eval:check_spamcop_uri_rbl('ws.surbl.org','127.0.0.2')
describe SA_URI_RBL URI's domain appears in spamcop database at ws.surbl.org
tflags SA_URI_RBL net
score SA_URI_RBL 3.0
(Likewise in SpamAssassin 3.0 with urirhsbl:)
urirhsbl URIBL_SA_SURBL ws.surbl.org. A
header URIBL_SA_SURBL eval:check_uridnsbl('URIBL_SA_SURBL')
describe URIBL_SA_SURBL Contains a URL listed in the SA SURBL blocklist
tflags URIBL_SA_SURBL net
score URIBL_SA_SURBL 3.0
You can run either SURBL or both if you like. Note that
ws has a higher spam detection rate (currently) but also
a somewhat higher false positive rate than sc. Here's
a corpus check Dan Quinlan ran:
OVERALL% SPAM% HAM% S/O RANK SCORE NAME
11189 1200 9989 0.107 0.00 0.00 (all messages)
100.000 10.7248 89.2752 0.107 0.00 0.00 (all messages as %)
6.095 56.2500 0.0701 0.999 1.00 1.00 URIBL_SC_SURBL
6.855 59.7500 0.5006 0.992 0.98 1.00 URIBL_SBL
9.545 72.8333 1.9421 0.974 0.95 0.01 T_URIBL_SA_SURBL
0.116 0.5000 0.0701 0.877 0.58 0.01 T_URIBL_DSBL
SA_SURBL above reflects the old name for ws; SC_SURBL is
sc.surbl.org. ws detected ~73% of spams in the spam corpus
with a ~1.9% FP rate in the ham corups. sc detected ~56%
with a <0.1% FP rate.
We're still tuning how the SpamCop data is used, so the sc
hit rates should improve and FPs decrease hopefully in the
next version of the sc data engine.
Cheers,
Jeff C.
--
Jeff Chan
mailto:jeffc at surbl.org
http://www.jeffchan.com/
More information about the Announce
mailing list