Discuss

discuss@lists.surbl.org

2 participants
1873 discussions

Thanks Jeff, 0.019 works on Rh
by Thomas Kinghorn 22 Jul '04

22 Jul '04

Hi Jeff. Thanks for the pointer. 0.019 worked, it just skipped the rd.yahoo.com test. <snip> t/open_redirect....ok 5/5 skipped: Need reliable open redirect to test against - rd.yahoo.com is closed t/spamcopuri.......ok t/whitelist........ok All tests successful, 5 subtests skipped. <snip> I have a bunch of cf files installed. They were downloaded from SARE. Which ones would you advise that I remove? Here is the list: 70_sare_adult.cf 70_sare_bayes_poison_nxm.cf 70_sare_header_abuse.cf 70_sare_oem.cf 70_sare_random.cf 70_sare_specific.cf 70_sare_spoof.cf 70_sc_top200.cf 71_sare_redirect_pre3.0.0.cf 99_FVGT_Tripwire.cf 99_sare_fraud_post25x.cf antidrug.cf backhair.cf bigevil.cf bogus-virus-warnings.cf chickenpox.cf DomainDigits1.cf evilnumbers.cf evilrules.cf Obfu1.cf ratware.cf weeds.cf It is killing the CPU :o$ Regards, Tom Kinghorn

3 2

RE: [SURBL-Discuss] Thanks Jeff, 0.019 works on Rh
by Thomas Kinghorn 22 Jul '04

22 Jul '04

> -----Original Message----- > From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] > Sent: 22 July 2004 09:32 > To: SURBL Discussion list > Subject: Re: [SURBL-Discuss] Thanks Jeff, 0.019 works on Rh > > Hi! > > > bigevil.cf > > Thats one that is doing a lot if think. CPU wise, its included in > ws.surbl.org, so remove that one... > Do I just add ws in spamcop_uri.cf? The standard 1 from the installation source is # vi spamcop_uri.cf uri SPAMCOP_URI_RBL eval:check_spamcop_uri_rbl('sc.surbl.org','127.0.0.2') describe SPAMCOP_URI_RBL URI's domain appears in spamcop database at sc.surbl.org tflags SPAMCOP_URI_RBL net score SPAMCOP_URI_RBL 3.0 Sorry for the lame question. Thanks Tom

2 1

FW: [SURBL-Discuss] Thanks Jeff, 0.019 works on Rh: GOT IT
by Thomas Kinghorn 22 Jul '04

22 Jul '04

Sorry all. It would help if I read further down in the page :o$ <snip> More SURBL lists ws.surbl.org - sa-blacklist in SURBL form In addition to the original SpamCop URI-derived SURBL sc.surbl.org, we are pleased to have another SURBL compatible with the above plugins, or any other software that can check message body domains against a name-based RBL. <snip> Sorry for wasting your time Regards Tom -----Original Message----- From: Thomas Kinghorn Sent: 22 July 2004 09:59 To: 'SURBL Discussion list' Subject: RE: [SURBL-Discuss] Thanks Jeff, 0.019 works on Rh > -----Original Message----- > From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] > Sent: 22 July 2004 09:32 > To: SURBL Discussion list > Subject: Re: [SURBL-Discuss] Thanks Jeff, 0.019 works on Rh > > Hi! > > > bigevil.cf > > Thats one that is doing a lot if think. CPU wise, its included in > ws.surbl.org, so remove that one... > Do I just add ws in spamcop_uri.cf? The standard 1 from the installation source is # vi spamcop_uri.cf uri SPAMCOP_URI_RBL eval:check_spamcop_uri_rbl('sc.surbl.org','127.0.0.2') describe SPAMCOP_URI_RBL URI's domain appears in spamcop database at sc.surbl.org tflags SPAMCOP_URI_RBL net score SPAMCOP_URI_RBL 3.0 Sorry for the lame question. Thanks Tom

1 0

SA2.63 make problems
by Thomas Kinghorn 22 Jul '04

22 Jul '04

Hi List. I am new to SURBL and am trying to install On a RH8 platform running sa-exim and SA-2.63 Make is fine Make test fails with the following error. <snip> ]# perl Makefile.PL # SAPATH /usr/lib/perl5/site_perl/5.8.0 # installsitelib /usr/lib/perl5/site_perl/5.8.0 # INSTALLDIRS site Checking if your kit is complete... Looks good Writing Makefile for Mail::SpamAssassin::SpamCopURI # make cp lib/Mail/SpamAssassin/PerMsgStatus.pm blib/lib/Mail/SpamAssassin/PerMsgStatus.pm cp lib/Mail/SpamAssassin/Conf.pm blib/lib/Mail/SpamAssassin/Conf.pm cp lib/Mail/SpamAssassin/SpamCopURI.pm blib/lib/Mail/SpamAssassin/SpamCopURI.pm Manifying blib/man3/Mail::SpamAssassin::Conf.3pm Manifying blib/man3/Mail::SpamAssassin::PerMsgStatus.3pm Manifying blib/man3/Mail::SpamAssassin::SpamCopURI.3pm # make test PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/blacklist........ok t/dnsrbl...........ok t/extract_urls.....ok t/mailto...........ok t/open_redirect....NOK 1# Failed test (t/open_redirect.t at line 37) # Failed test (t/open_redirect.t at line 44) t/open_redirect....NOK 2# Failed test (t/open_redirect.t at line 52) t/open_redirect....ok 4/5# Looks like you failed 3 tests of 5. t/open_redirect....dubious Test returned status 3 (wstat 768, 0x300) DIED. FAILED tests 1-3 Failed 3/5 tests, 40.00% okay t/spamcopuri.......ok t/whitelist........ok Failed Test Stat Wstat Total Fail Failed List of Failed ---------------------------------------------------------------------------- --- t/open_redirect.t 3 768 5 3 60.00% 1-3 Failed 1/7 test scripts, 85.71% okay. 3/57 subtests failed, 94.74% okay. make: *** [test_dynamic] Error 29 A shove in the right direction would be appreciated. Many thanks Regards, Tom Kinghorn

2 1

RE: [SURBL-Discuss] RE: 6dos data into ds.surbl.org
by Joseph Burford 21 Jul '04

21 Jul '04

Jeff, > Yikes! I'd say 4 to 5 percent FPs is unworkable for a SURBL.... I should have clarified that. The 4 to 5 percent on close examination is always email that is borderline IMHO. It just didn't end up being tagged as spam in the end. Compared with a .1 to .5 percent FP on the other surbl lists it still isn't that great. As for being unworkable it depends on your setup. I was tagging DS with a low score, one of the great things with SpamAssassin is that you have things like Bayes to combat FPs and the end result is the ham gets through :) Regards, Joseph

3 3

Re: RE: [SURBL-Discuss] Re: sex.surbl.org
by Rob McEwen 20 Jul '04

20 Jul '04

I still vote YES on adding the sex sites (in a separate DNS feed). (1) It seems like all the technology and know-how is in place to do this... maybe with a little tweaking, but nothing different than what has already been done elsewhere. (2) It would be a separate list and its use would be completely voluntary. Therefore, this seems to me to be MORE a question of "are there sufficient YET votes to make it worthwhile"... and NOT so much a question of comparing the "yes" vs. "no" votes because the "no" votes can simply choose to not participate... which is easy.... simply don't do anything different from what you are already doing. (3) Its purpose and scope could easily be explained on the SURBL.org site in its own page. It could even be omitted from being mentioned on any other pages to avoid confusion. Rob McEwen

2 1

RE: [SURBL-Discuss] WS FP? yourdomain-MUNGED.com
by Chris Santerre 20 Jul '04

20 Jul '04

>-----Original Message----- >From: Ryan Thompson [mailto:surbl@sasknow.com] >Sent: Tuesday, July 20, 2004 11:49 AM >To: SURBL Discussion list >Subject: [SURBL-Discuss] WS FP? yourdomain-MUNGED.com > > > >So, I'm a filthy spammer, I guess. I just sent out a mass >email like so: > >> 2. At the opening page, enter either your email address (for >> example, info(a)yourdomain-MUNGED.com), or your username (for >> example, yd-info). > >I was a little surprised to see yourdomain.com come back with hits on >WS. Maybe I'll have to start using >"info(a)yourdomainthatnobodywilleverlistinsurbl.org", but that's a bugger >to word-wrap. :-) > >Seriously, what's the deal? Is yourdomain.com really a spamvertized >site, or is it just an innocent victim? A quick grep of >~10,000s/10,000h >had this hit on 0s/6h. (And only one of them was me :-) > >- Ryan > Quite curious. These show up in the 6dos misc.c file: yourdomain.biz yourdomain.com But no tmuch other then munged listings in NANAS. I think these should be whitelisted!!!! --Chris

2 1

RE: [SURBL-Discuss] exacttarget-MUNGED.com
by Chris Santerre 20 Jul '04

20 Jul '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, July 19, 2004 5:15 PM >To: Chris Santerre >Cc: 'SURBL Discussion list'; rob(a)pvsys.com >Subject: Re: [SURBL-Discuss] exacttarget-MUNGED.com > > >On Monday, July 19, 2004, 9:42:29 AM, Chris Santerre wrote: >>>On Mon, 19 Jul 2004, Rob McEwen wrote: > >>>> The offending domain found in this newsletter is the following: >>>> >>>> exacttarget-MUNGED.com > >> These guys apear to be shammers (Spam and ham). NANAS has a >bunch of posts. >> I believe they were added due to a Home Depot spam run to a bunch of >> harvested addresses. They are NOT white. > >Somewhat in their defense, they appear to be a commercial mailing >company with quasi-reasonable (not 100% confirmed opt-in?) >anti-spam policies: > > http://website.exacttarget.com/exacttarget_company_antispam.asp > > http://website.exacttarget.com/exacttarget_bestpractices_permission.asp >Perhaps Home Depot was an isolated incident with a bad data source. Agreed. They may have hired a shady marketer that did the run without them knowing. However if any of you have a Keep-An-Eye-On file, I would put these guys in it. --Chris

1 0

[SURBL-Discuss] RE: sex.surbl.org (was: Re: include IP lookups in SURBL lists)
by Chris Santerre 20 Jul '04

20 Jul '04

*snip* >At nearly 500k record we'd definitely want to do this >with rbldnsd. BIND is already getting pretty slow with lists >approaching 100k records. For comparison, sbl.spamhaus.org >has about 5k records, xbl has about 1.7 million records, >list.dsbl.org has nearly 4 million records. multi.surbl.org, >our largest production list has about 45k records. It keeps growning fast! > >How does anyone else feel about turning this list of sex sites >into a SURBL? > >Jeff C. +1 for me. Keeping it a seperate list is a great idea. Gives admins the choice. Especially ISPs who may only wish to tag spam, but allow customers to look at the occasional naughty boom boom kissy kissy :) --Chris

4 3

lindowsinc.com FP in OB.
by Patrik Nilsson 20 Jul '04

20 Jul '04

lindowsinc.com is currently listed in OB. Can't see any reason why it should be listed. Not mentioned in any NANAS reports. Patrik

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss