Re: [sa] Re: emailreg.org - tainted white list

2009-12-17 Thread Charles Gregory
On Thu, 17 Dec 2009, Yet Another Ninja wrote: On 12/16/2009 6:16 PM, Charles Gregory wrote: On Wed, 16 Dec 2009, Yet Another Ninja wrote: blabber... checkout SVN - follow dev list... HABEAS is history... I believe the *point* here is that HABEAS is NOT 'history' for ordinary systems

RE: [sa] RE: emailreg.org - tainted white list

2009-12-16 Thread R-Elists
Still doesn't answer my question. Perhaps I'm dense. But to spell out my question more explicitly: what do you mean by personal response spam? Is that just Richard's on-list responses we've all seen? Or something else? (did I miss that part of the conversation?). And what do you

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread Daniel J McDonald
On Mon, 2009-12-14 at 23:07 +0100, Yet Another Ninja wrote: On 12/14/2009 10:55 PM, Daniel J McDonald wrote: I'd love to have the clamav unofficial signature families scored. I have a fine guess as to how relevant they are, but it is just that - a guess. someone, somewhere is alreay

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread Martin Gregorie
On Tue, 2009-12-15 at 07:29 -0600, Daniel J McDonald wrote: That's the issue with pulling all of the whitelists out of the scoring mix - the whitelist components are part of the mix that allows 5 points to indicate spam. And I was trying to counter the argument that we should simply rip those

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread Charles Gregory
On Tue, 15 Dec 2009, Martin Gregorie wrote: Clarification: I, for one, was only proposing that the whitelisting plugins and rules that query external databases are removed from the standard ruleset and sa_update and placed in a separate library of optional rules. The 'issue' (as I see it) is

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread jdow
From: Charles Gregory cgreg...@hwcn.org Sent: Monday, 2009/December/14 12:35 On Tue, 15 Dec 2009, Michael Hutchinson wrote: If everyone could ignore the taunting, and just carry on, there wouldn't be an issue. The taunting *is* the issue. The rest of the arguments, about design and

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread Rob McEwen
jdow wrote: his response personal spam to this account has increased sharply Uuh, what does that mean, exactly? -- Rob McEwen http://dnsbl.invaluement.com/ r...@invaluement.com +1 (478) 475-9032

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread Christian Brel
On Tue, 15 Dec 2009 11:01:51 -0800 jdow j...@earthlink.net wrote: From: Charles Gregory cgreg...@hwcn.org Sent: Monday, 2009/December/14 12:35 On Tue, 15 Dec 2009, Michael Hutchinson wrote: If everyone could ignore the taunting, and just carry on, there wouldn't be an issue. The

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread jdow
From: Rob McEwen r...@invaluement.com Sent: Tuesday, 2009/December/15 11:10 jdow wrote: his response personal spam to this account has increased sharply Uuh, what does that mean, exactly? A possible cause and effect exists. I can neither prove nor disprove it. the fact exists. {^_^}

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread jdow
From: Christian Brel brel.spamassassin091...@copperproductions.co.uk Sent: Tuesday, 2009/December/15 11:54 On Tue, 15 Dec 2009 11:01:51 -0800 jdow j...@earthlink.net wrote: Perhaps are some kind of spammer trying to divert attention from yourself? Snicker I have longer bona fides on this

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread Chris Hoogendyk
jdow wrote: From: Rob McEwen r...@invaluement.com Sent: Tuesday, 2009/December/15 11:10 jdow wrote: his response personal spam to this account has increased sharply Uuh, what does that mean, exactly? A possible cause and effect exists. I can neither prove nor disprove it. the fact

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread Rob McEwen
jdow wrote: jdow wrote: his response personal spam to this account has increased sharply Uuh, what does that mean, exactly? A possible cause and effect exists. I can neither prove nor disprove it. the fact exists. Still doesn't answer my question. Perhaps I'm dense. But to spell out my

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread John Hardin
On Tue, 15 Dec 2009, Rob McEwen wrote: jdow wrote: jdow wrote: his response personal spam to this account has increased sharply Uuh, what does that mean, exactly? A possible cause and effect exists. I can neither prove nor disprove it. the fact exists. Still doesn't answer my question.

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread jdow
From: Rob McEwen r...@invaluement.com Sent: Tuesday, 2009/December/15 13:13 jdow wrote: jdow wrote: his response personal spam to this account has increased sharply Uuh, what does that mean, exactly? A possible cause and effect exists. I can neither prove nor disprove it. the fact exists.

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread Christian Brel
On Tue, 15 Dec 2009 14:11:13 -0800 jdow j...@earthlink.net wrote: From: Rob McEwen r...@invaluement.com Sent: Tuesday, 2009/December/15 13:13 jdow wrote: jdow wrote: his response personal spam to this account has increased sharply Uuh, what does that mean, exactly? A possible

Re: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Charles Gregory
On Tue, 15 Dec 2009, Michael Hutchinson wrote: If everyone could ignore the taunting, and just carry on, there wouldn't be an issue. The taunting *is* the issue. The rest of the arguments, about design and defaults, are carried on by numerous individuals in a quite civilized manner. But when

Re: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Bob O'Brien
Charles Gregory wrote: I ask again, on the issue of whitelists, is there a serious issue with spammers targetting white-listed IP's as favored candidates for hacking? I'm okay with the answer being 'no'. I'm sure people with large servers and good statistics could answer this question. But I

Re: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Charles Gregory
On Mon, 14 Dec 2009, Bob O'Brien wrote: I can mostly just offer opinion, and that would be that whitelisting is not (yet) in wide enough use to have become a sufficiently attractive target. Which brings us back to the 'rational version' of the discussion about SA weighing whitelists

Re: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Martin Gregorie
May I suggest that handling whitelist or blacklist rules and any associated plugins by packaging them as separately installable modules may be of benefit to SA maintainers. The idea is to reduce the SA dev workload by handing off responsibility for maintaining and bugfixing such modules to

Re: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Yet Another Ninja
On 12/14/2009 10:23 PM, Martin Gregorie wrote: May I suggest that handling whitelist or blacklist rules and any associated plugins by packaging them as separately installable modules may be of benefit to SA maintainers. The idea is to reduce the SA dev workload by handing off responsibility for

Re: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Daniel J McDonald
On Mon, 2009-12-14 at 21:23 +, Martin Gregorie wrote: May I suggest that handling whitelist or blacklist rules and any associated plugins by packaging them as separately installable modules may be of benefit to SA maintainers. The idea is to reduce the SA dev workload by handing off

Re: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Martin Gregorie
On Mon, 2009-12-14 at 22:39 +0100, Yet Another Ninja wrote: your modules are all there already and much of it is already managed as you suggest: they're called rules.. you can even switch them on or off, or add your own modules /plugins/modules. SA provides an Open Source FRAMEWORK which

Re: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Yet Another Ninja
On 12/14/2009 10:55 PM, Daniel J McDonald wrote: I'd love to have the clamav unofficial signature families scored. I have a fine guess as to how relevant they are, but it is just that - a guess. someone, somewhere is alreay converting ClamV signatures to HUGE (slow) rule files, forgot

RE: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Michael Hutchinson
Hello, The taunting *is* the issue. The rest of the arguments, about design and defaults, are carried on by numerous individuals in a quite civilized manner. But when someone starts throwing arond stupid accusations, then the person attacked focuses their efforts on 'defending' themselves,

hacking whitelists (was Re: [sa] RE: emailreg.org - tainted white list)

2009-12-14 Thread J.D. Falk
On Dec 14, 2009, at 1:35 PM, Charles Gregory wrote: I ask again, on the issue of whitelists, is there a serious issue with spammers targetting white-listed IP's as favored candidates for hacking? I'm okay with the answer being 'no'. I'm sure people with large servers and good statistics