[SURBL-Discuss] Re: Which rules are replaces by *.surbl.org?

[Jeff Chan]

[setting back to the correct distribution list; I broke it by
manually setting the SA developers list before.]

On Monday, June 14, 2004, 4:18:02 PM, Raymond Dijkxhoorn wrote:
>> > Yes, but I want to add that there _WILL_ be a "BigEvil style" cf version of
>> > ws.surbl.org for those people who won't/can't use the SURBL net lookups for
>> > some strange reason. This is still being worked on. One of the main reasons
>> > I haven't updates BE in a while is because I've been working on the new WS
>> > submission stuff. (Thanks to everyone who is involved in that!)
>> 
>> Thanks, I forgot about that other direction of rules style
>> entries moving from sa-blacklist back into bigevil.cf.  Sounds
>> like the best of both worlds in a nice mirror of both types:
>> 
>> A.  ws.surbl.org gets all the "static" domains from BigEvil,
>> sa-blacklist, etc. in the form of a SURBL.
>> 
>> B.  BigEvil.cf gets all the domains, including those from
>> sa-blacklist, heavily wildcarded ones, etc. in the form of a
>> ruleset. 

> I dont see the problem listsing them inside a SURBL. The extra few kb it 
> will take on the nameservers ? For me i would like to put the preassure on 
> DNS, not on every single box that has to do expression lookups, those will 
> cost a lot more CPU... Most of the times its not the nameservers that cant 
> keep up, but the mailboxes... 

ws.surbl.org will continue to get all the domains that are
practical to enumerate from sa-blacklist, BigEvil.cf, MidEvil.cf,
etc.  We don't be getting heavily wildcarded ones or ones with
regular expression ranges, etc, into SURBLs since BIND and
rbldnsd would not know how to handle them.

Something like *spammer.biz would be impossible to enumerate,
for example, whereas spammer[0-2].biz can be successfully
enumerated and would be included in ws.surbl.org as spammer0.biz,
spammer1.biz, spammer2.biz .

Does that sound right?  :-)

>> Also: *when should we announce that be domains are now in ws, and
>> that people should stop using be?*   Is everyone comfortable that
>> the combined ws is now working as expected, including the be
>> domains being folded in?

> Yes. Let me know when i should start slaving them. Same applies for the 
> rsync... 

ws and be changes should propagate automatically as things are
set up now. 

We're still waiting to hear back from people about the
performance, especially a false positive rate from ob.surbl.org
before announcing or distributing them.  And multi.surbl.org
presumably doesn't have code that can use it yet.  Those are the
only new lists needing some feedback/coding.

Jeff C.