Re: To Bill Cole

[Hai Ng]

I have been doing something similar to what you're doing Bill.

I've been analyzing the spam traffic that arrives on my local servers  
and where I locate that the originating server's IP looks like it  
belongs to a block assigned to dial-ups, DSL, cable or similar  
patterns, I blacklist an entire block proactively.

So far, I've encountered one false-positive due to a typo by me.  It  
was reported by a tech-savvy friend so I fixed that one.

I'm curious at what amount of false-positives you have been receiving?   
Do people contact you when they receive the blacklist error? Or does  
mail get lost when a false-positive is encountered?

Any experiences you can share?

Thanks!

-
nghai
On Dec 15, 2003, at 10:04 PM, Bill Cole wrote:

At 4:11 PM -0500 12/15/03, Clement Ross  imposed structure on a stream  
of electrons, yielding:
Hello Bill,

Now I know how it feels to be blacklisted as you are blocking
205.205/16 (Worldcom CA) which is the parent of my 205.205.87/24.  
That's
obviously why I'm contacting you through the list.
Hole punched. As it says somewhere on the website, I will punch a hole  
on any evidence that it will let legitimate mail through and not let  
spam in.

Anyway.

I just consolidated the 24/8 address space to free some much needed
space in my SIMS blacklist. I noted that you do the same in your Solid
Clues Blacklist.
Would you mind sharing the exceptions that you are whitelisting in  
that
block?
None. If I were exempting anyone, you'd see a breakup like the one I  
have for 12/8.

This is a demo of why I have the big scary warning atop  
http://www.scconsult.com/blacklist.shtml. That blacklist is based on  
local experience. I have a unique local experience. The fact that 4/8,  
24/8, 38/8 and most of 12/8 are shunned here is not a recommendation  
for anyone else, but rather an expression of what I find useful for my  
idiosyncratic mail stream. Given that over 90% of what is offered to  
me is spam, I have found it useful to be proactive in my blocking. 3/4  
of the places I reject on any given day based solely on my blacklist  
are in other blacklists I use within a week.

--  
Bill Cole
[EMAIL PROTECTED]

#############################################################
This message is sent to you because you are subscribed to
 the mailing list <[EMAIL PROTECTED]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to  <[EMAIL PROTECTED]>

________________________________________________________________________ 
_
Hai Ng
"Virtual Tools for the Real World"

#############################################################
This message is sent to you because you are subscribed to
 the mailing list <[EMAIL PROTECTED]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to  <[EMAIL PROTECTED]>