[SURBL-Discuss] Fwd: Re: blacklist brings system to halt

Jeff Chan jeffc at surbl.org
Wed Jun 30 00:06:00 CEST 2004

Here's some additional info on some of the recent
sa-blacklist/ws.surbl.org/6dos goings on, copied from a
message I sent to the SpamAssassin-users list:

> 1477667 Jun 21 18:48 /etc/spamassassin/RulesDuJour/blacklist.cf.20040623-0106
>  421286 Jun 21 18:49 /etc/spamassassin/RulesDuJour/blacklist-uri.cf.20040623-0106
> 1459329 Jun 23 00:03 /etc/spamassassin/RulesDuJour/blacklist.cf.20040624-1602
>  415544 Jun 23 00:04 /etc/spamassassin/RulesDuJour/blacklist-uri.cf.20040624-1602
> 1484137 Jun 24 15:48 /etc/spamassassin/RulesDuJour/blacklist.cf.20040627-0301
>  422228 Jun 24 15:49 /etc/spamassassin/RulesDuJour/blacklist-uri.cf.20040627-0301
> 1559813 Jun 27 02:17 /etc/spamassassin/RulesDuJour/blacklist.cf.20040628-1544
>  443922 Jun 27 02:18 /etc/spamassassin/RulesDuJour/blacklist-uri.cf.20040628-1544
> 5432965 Jun 28 15:25 /etc/spamassassin/RulesDuJour/blacklist.cf.20040628-1558
> 1544207 Jun 28 15:28 /etc/spamassassin/blacklist-uri.cf
> 7070231 Jun 28 15:54 /etc/spamassassin/blacklist.cf

I think I can help explain why sa-blacklist went from 1.5 MB
to 5.5 MB in size suddenly.  Chris Santerre added a fairly large
set of records from 6dos (6 degrees of spam) around that time in
order to get the records into ws.surbl.org and sa-blacklist.
Chris, Bill and I then discussed this and decided to take them
back out of sa-blacklist and therefore ws.surbl.org, and put
the 6dos entries into its own SURBL instead.

However Bill's server experienced a hard disk problem around
the same time so the entries have not come out of sa-blacklist
yet.  But they will come out once Chris gets access to Bill's
server again.  Until then, backing off to an earlier version
of sa-blacklist makes perfect sense and it's what we've done
for ws.surbl.org.

When Chris gets in again, he will get the 6dos entries off
sa-blacklist, it will come back down in size, and I'll restore
live feeds of ws.surbl.org from the sa-blacklist data instead
of freezing it at the older version, as it is now.

Hopefully this makes some sense.  If not I'll glady try to
answer any questions or comments anyone has, though I'm not
the original source of the changes.

Jeff C.
Jeff Chan
mailto:jeffc at surbl.org

More information about the Discuss mailing list