Re: [sa] Re: emailreg.org - tainted white list

2009-12-17 Thread Charles Gregory
On Thu, 17 Dec 2009, Yet Another Ninja wrote: On 12/16/2009 6:16 PM, Charles Gregory wrote: On Wed, 16 Dec 2009, Yet Another Ninja wrote: > blabber... checkout SVN - follow dev list... HABEAS is history... I believe the *point* here is that HABEAS is NOT 'history' for ordinary systems runnin

RE: [sa] RE: emailreg.org - tainted white list

2009-12-16 Thread R-Elists
> Still doesn't answer my question. Perhaps I'm "dense". But to > spell out my question more explicitly: > > what do you mean by "personal response spam"? Is that just > Richard's on-list responses we've all seen? Or something > else? (did I miss that part of the conversation?). And what >

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread Christian Brel
On Tue, 15 Dec 2009 14:11:13 -0800 "jdow" wrote: > From: "Rob McEwen" > Sent: Tuesday, 2009/December/15 13:13 > > > > jdow wrote: > >>> jdow wrote: > his response personal spam to this account has increased sharply > >>> Uuh, what does that mean, exactly? > >> A possible cause and effect

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread jdow
From: "Rob McEwen" Sent: Tuesday, 2009/December/15 13:13 jdow wrote: jdow wrote: his response personal spam to this account has increased sharply Uuh, what does that mean, exactly? A possible cause and effect exists. I can neither prove nor disprove it. the fact exists. Still doesn't ans

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread John Hardin
On Tue, 15 Dec 2009, Rob McEwen wrote: jdow wrote: jdow wrote: his response personal spam to this account has increased sharply Uuh, what does that mean, exactly? A possible cause and effect exists. I can neither prove nor disprove it. the fact exists. Still doesn't answer my question. Per

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread Rob McEwen
jdow wrote: >> jdow wrote: >>> his response personal spam to this account has increased sharply >> Uuh, what does that mean, exactly? > A possible cause and effect exists. I can neither prove nor disprove > it. the fact exists. Still doesn't answer my question. Perhaps I'm "dense". But to spell ou

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread Chris Hoogendyk
jdow wrote: From: "Rob McEwen" Sent: Tuesday, 2009/December/15 11:10 jdow wrote: his response personal spam to this account has increased sharply Uuh, what does that mean, exactly? A possible cause and effect exists. I can neither prove nor disprove it. the fact exists. Properly known

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread jdow
From: "Christian Brel" Sent: Tuesday, 2009/December/15 11:54 On Tue, 15 Dec 2009 11:01:51 -0800 "jdow" wrote: Perhaps are some kind of spammer trying to divert attention from yourself? I have longer bona fides on this list than I suspect you do and my partner is a currently inactive SARE

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread jdow
From: "Rob McEwen" Sent: Tuesday, 2009/December/15 11:10 jdow wrote: his response personal spam to this account has increased sharply Uuh, what does that mean, exactly? A possible cause and effect exists. I can neither prove nor disprove it. the fact exists. {^_^}

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread Christian Brel
On Tue, 15 Dec 2009 11:01:51 -0800 "jdow" wrote: > From: "Charles Gregory" > Sent: Monday, 2009/December/14 12:35 > > > > On Tue, 15 Dec 2009, Michael Hutchinson wrote: > >> If everyone could ignore the taunting, and just carry on, there > >> wouldn't be an issue. > > > > The taunting *is* the

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread Rob McEwen
jdow wrote: > his response personal spam to this account has increased sharply Uuh, what does that mean, exactly? -- Rob McEwen http://dnsbl.invaluement.com/ r...@invaluement.com +1 (478) 475-9032

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread jdow
From: "Charles Gregory" Sent: Monday, 2009/December/14 12:35 On Tue, 15 Dec 2009, Michael Hutchinson wrote: If everyone could ignore the taunting, and just carry on, there wouldn't be an issue. The taunting *is* the issue. The rest of the arguments, about design and defaults, are carried o

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread Charles Gregory
On Tue, 15 Dec 2009, Martin Gregorie wrote: Clarification: I, for one, was only proposing that the whitelisting plugins and rules that query external databases are removed from the standard ruleset and sa_update and placed in a separate library of optional rules. The 'issue' (as I see it) is th

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread Martin Gregorie
On Tue, 2009-12-15 at 07:29 -0600, Daniel J McDonald wrote: > That's the issue with pulling all of the whitelists out of the scoring > mix - the whitelist components are part of the mix that allows 5 points > to indicate spam. And I was trying to counter the argument that we > should simply rip th

Re: [sa] RE: emailreg.org - tainted white list

2009-12-15 Thread Daniel J McDonald
On Mon, 2009-12-14 at 23:07 +0100, Yet Another Ninja wrote: > On 12/14/2009 10:55 PM, Daniel J McDonald wrote: > > I'd love to have the clamav unofficial signature families scored. I > > have a fine guess as to how relevant they are, but it is just that - a > > guess. > > someone, somewhere is

hacking whitelists (was Re: [sa] RE: emailreg.org - tainted white list)

2009-12-14 Thread J.D. Falk
On Dec 14, 2009, at 1:35 PM, Charles Gregory wrote: > I ask again, on the issue of whitelists, is there a serious issue with > spammers targetting white-listed IP's as favored candidates for hacking? > I'm okay with the answer being 'no'. I'm sure people with large servers and > good statistics

RE: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Michael Hutchinson
Hello, > The taunting *is* the issue. The rest of the arguments, about design > and > defaults, are carried on by numerous individuals in a quite civilized > manner. But when someone starts throwing arond stupid accusations, then > the person attacked focuses their efforts on 'defending' themselve

Re: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Yet Another Ninja
On 12/14/2009 10:55 PM, Daniel J McDonald wrote: I'd love to have the clamav unofficial signature families scored. I have a fine guess as to how relevant they are, but it is just that - a guess. someone, somewhere is alreay converting ClamV signatures to HUGE (slow) rule files, forgot where

Re: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Martin Gregorie
On Mon, 2009-12-14 at 22:39 +0100, Yet Another Ninja wrote: > your modules are all there already and much of it is already managed as > you suggest: they're called rules.. you can even switch them on or off, > or add your own "modules" /plugins/modules. > > SA provides an Open Source FRAMEWORK

Re: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Daniel J McDonald
On Mon, 2009-12-14 at 21:23 +, Martin Gregorie wrote: > May I suggest that handling whitelist or blacklist rules and any > associated plugins by packaging them as separately installable modules > may be of benefit to SA maintainers. The idea is to reduce the SA dev > workload by handing off res

Re: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Yet Another Ninja
On 12/14/2009 10:23 PM, Martin Gregorie wrote: May I suggest that handling whitelist or blacklist rules and any associated plugins by packaging them as separately installable modules may be of benefit to SA maintainers. The idea is to reduce the SA dev workload by handing off responsibility for m

Re: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Martin Gregorie
May I suggest that handling whitelist or blacklist rules and any associated plugins by packaging them as separately installable modules may be of benefit to SA maintainers. The idea is to reduce the SA dev workload by handing off responsibility for maintaining and bugfixing such modules to external

Re: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Charles Gregory
On Mon, 14 Dec 2009, Bob O'Brien wrote: I can mostly just offer opinion, and that would be that whitelisting is not (yet) in wide enough use to have become a sufficiently attractive target. Which brings us back to the 'rational version' of the discussion about SA weighing whitelists favorably

Re: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Bob O'Brien
Charles Gregory wrote: I ask again, on the issue of whitelists, is there a serious issue with spammers targetting white-listed IP's as favored candidates for hacking? I'm okay with the answer being 'no'. I'm sure people with large servers and good statistics could answer this question. But I get

Re: [sa] RE: emailreg.org - tainted white list

2009-12-14 Thread Charles Gregory
On Tue, 15 Dec 2009, Michael Hutchinson wrote: If everyone could ignore the taunting, and just carry on, there wouldn't be an issue. The taunting *is* the issue. The rest of the arguments, about design and defaults, are carried on by numerous individuals in a quite civilized manner. But when