[SURBL-Discuss] Re: New xs.surbl list

Patrik Nilsson patrik at patrik.com
Fri Apr 22 20:47:25 CEST 2005


At 01:38 2005-04-22 -0700, Jeff Chan wrote:
>[forwarded with Paul's permission.  Please comment.]
> >         I don't know the current method used to decide when to add domains
> > to your new list, and I definitely see *much* smaller levels of spam than
> > many others on the various mailing lists.
>
>It's the top 97th percentile of hits, which only gets about a
>hundred more new records (domains and IPs) than we already have
>in SURBLs.  We can crank that up later when we get the FP issues
>nailed down better, though improved processing techniques.
>
> > However, my own experience, so far,
> > is that absolutely no "zero-hour" spams have been caught,
>
>Yes, that's because the new URI hit counts must overcome the
>mass of earlier reports.  There may be smarter ways to organize
>this, but simply lowering the threshold of inclusion (e.g., going
>to the 98th percentile) would get more on the list sooner.
>
> > but very many Spamcop
> > reports (about 1/2 hour later) do trigger;  So I have to agree with the 
> few who
> > have suggested a much more aggressive decision about when to add.
>
>Yes, I agree too.  :-)  When I announced the list for testing I
>said we'd start conservative to get a feeling for the data.

Could we maybe, just for testing, have two or more lists to test with 
different percentiles?
97.xs.surbl.org
98.xs.surbl.org
etc...

Patrik 



More information about the Discuss mailing list