[SURBL-Discuss] Re: New xs.surbl list

[Jeff Chan]

On Friday, April 22, 2005, 11:47:25 AM, Patrik Nilsson wrote:
> At 01:38 2005-04-22 -0700, Jeff Chan wrote:
>>[forwarded with Paul's permission.  Please comment.]
>> >         I don't know the current method used to decide when to add domains
>> > to your new list, and I definitely see *much* smaller levels of spam than
>> > many others on the various mailing lists.
>>
>>It's the top 97th percentile of hits, which only gets about a
>>hundred more new records (domains and IPs) than we already have
>>in SURBLs.  We can crank that up later when we get the FP issues
>>nailed down better, though improved processing techniques.
>>
>> > However, my own experience, so far,
>> > is that absolutely no "zero-hour" spams have been caught,
>>
>>Yes, that's because the new URI hit counts must overcome the
>>mass of earlier reports.  There may be smarter ways to organize
>>this, but simply lowering the threshold of inclusion (e.g., going
>>to the 98th percentile) would get more on the list sooner.
>>
>> > but very many Spamcop
>> > reports (about 1/2 hour later) do trigger;  So I have to agree with the 
>> few who
>> > have suggested a much more aggressive decision about when to add.
>>
>>Yes, I agree too.  :-)  When I announced the list for testing I
>>said we'd start conservative to get a feeling for the data.

> Could we maybe, just for testing, have two or more lists to test with 
> different percentiles?
> 97.xs.surbl.org
> 98.xs.surbl.org
> etc...

> Patrik 

Probably we'll try XS at the 98th percentile next, take out the
SURBL hits, and try to list only domains that are less than a
year old.

How toes this sound to folks?

Jeff C.
--
"If it appears in hams, then don't list it."