Replying to the whole thread, but I had to grab an actual message to reply to.
ISTR some time ago talk about a RBL for hosts referenced inside emails, instead of just the sending ips. Seems like that would be ideal, especially if we go based on DNS name as well as ip address. So if we get a message with a uri of http://herbalslutmortgages.biz/whatever we would do a lookup on herbalslutmortgages.biz.hosts.my-favorite-blackhole.org and also (assuming herbalslutmortgages.biz resolves to 172.16.47.42) on 42.47.16.172.dns.my-favorite-blackhole.org. Of course, given the way the current RBLs have been treated recently, I'm not sure there are many who would really want to go into the business, but it does feel like the best way to handle things. On Tue, 18 Nov 2003, Carl R. Friend wrote: > On Mon, 17 Nov 2003, Justin Mason wrote: > > > BTW, given that a URI DB cannot use regular expressions, or patterns, > > would this really be useful? > > It would have the limited use of IDing specific domains that > get repeatedly "spamvertised" to the point where we (1) notice > them and (2) the spams don't score enough through the other > heuristics. Both of these are getting common enough now that > I (at least) feel that some very fast mechanism is warranted > to catch them. > > > I suspect doing this with a DB lookup may not be such a win, compared > > to using a local eval test that parses a config file and creates an > > in-memory hash table. > > Putting the list of domain names in a DB file has the important > side-effect of being dynamically-updatable and probably a bit more > memory-friendly than keeping thhe whole hash-table in core. If a > restart were required for each domain addition the performance > would truly suffer in a spamc/spamd environment. > > Cheers. > > +------------------------------------------------+---------------------+ > | Carl Richard Friend (UNIX Sysadmin) | West Boylston | > | Minicomputer Collector / Enthusiast | Massachusetts, USA | > | mailto:[EMAIL PROTECTED] +---------------------+ > | http://users.rcn.com/crfriend/museum | ICBM: 42:22N 71:47W | > +------------------------------------------------+---------------------+ > > > > ------------------------------------------------------- > This SF. Net email is sponsored by: GoToMyPC > GoToMyPC is the fast, easy and secure way to access your computer from > any Web browser or wireless device. Click here to Try it Free! > https://www.gotomypc.com/tr/OSDN/AW/Q4_2003/t/g22lp?Target=mm/g22lp.tmpl > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > -- Adam Lopresto <[EMAIL PROTECTED]> Unix System Administrator Center for Engineering Computing, Washington University ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
