[SURBL-Discuss] UGH.. More false positives

Ryan Thompson ryan at sasknow.com
Wed Dec 8 08:10:25 CET 2004


Ryan Thompson wrote to Jeff Chan and SURBL Discussion list on Tue, Dec 7th...:

> If I find anything interesting, I'll report back.

Ok, thankfully, nothing *too* interesting. :-) Out of the few thousand
messages we processed during those hours (10:15GMT - 13:22GMT; early in
the morning for us), about ten of them had URIBL hits on at least one of
the domains in Jeff's last message, and all ten of them were obvious
spam. Our other rules seemingly came to the rescue to separate the wheat
from the chaff. This is precisely why I like rules from multiple
sources/technologies. :-)

I don't have an easy way to tell if anything scored as _nonspam_ hit the
whitelisted entries[1], but that's not a concern, because anything under
7.0 points was already delivered normally.

[1] We don't include SA reports with nonspam, of course, so, it's
     possible to see if the SC_URIBL rule hit, but it isn't possible
     (without re-checking each message *against a modified SC blocklist
     with the bad data included*) to see if the URIBL rule hit one of the
     domains in question. And, anyway, for reasons discussed above, this
     would be for academic reasons only. :-)

Thanks again, Jeff. This would have taken a lot longer (and resulted in
further delayed mail delivery if there were any FPs) without the
timeline and domains you provided.

- Ryan

-- 
   Ryan Thompson <ryan at sasknow.com>

   SaskNow Technologies - http://www.sasknow.com
   901-1st Avenue North - Saskatoon, SK - S7K 1Y4

         Tel: 306-664-3600   Fax: 306-244-7037   Saskatoon
   Toll-Free: 877-727-5669     (877-SASKNOW)     North America


More information about the Discuss mailing list