On 4/15/10 5:35 PM, Micah Anderson wrote:
M
"The Distributed Checksum Clearinghouse source carries a license that is
free to organizations that do not sell filtering devices or services
except to their own users and that participate in the global DCC
network. . . you may not redistribute modified, "fixed," or "improved"
versions of the source or binaries. You also can't call it your own or
blame anyone for the results of using it."
Which seems silly for debian to remove it, since many of the blacklists
in SA are by default, licensed similar (free for non commercial use,
paid if > xxx queries). maybe debian should look through and remove ALL
'dual licensed' software, and when you install SA from the RPM's,
disable the dual licensed RBL's.
Or, hey, lets pretend the people installing debian are smart enough to
be able to make up their own mind if they fit the free license model.
So I guess I just will remove dcc, that is a shame, it seems like a good
service.
it IS a good service, and SA 3.3x supports the reputation query directly
now in the commercial license.
Some things to understand, (normal language vs legal talk)
* if you are doing > 100,000 queries a day (100,000 emails a day hit
SA, and thus dcc), its a lot better, and faster to use a local dcc
server.
* If you are using the public servers, their is a built in 1000ms
delay (so if you are using < 100K queries a day, its faster to use
the commercial service)
* public servers don't have the reputations scores (see new scores
for dcc..). double the accuracy.
* if you are an isp, just using it for your customers, you don't
need to pay for the commercial license (no reputation, still
1000ms delays to public servers)
* (but you still might want to. its CHEAP, faster by 1000ms per
query, and with DCC reputations, more accurate)
DCC reputations not only allows SA to score on the fuzzy checksums of
the emails, but score on the 'bulk vs non bulk' reputation of the
sending ip.
zero day spams (bulk!) from known bulk sources can be picked up immediately.
zero say zombots with known spam (bulk) using a new ip can be picked up
immediately with old scores.
the combination of this makes it very accurate, both with catching new
bulk providers, and cutting down on FP's.
did I say its CHEAP, and if you are an isp using it for your own
customers you don't need a license?
If you aren't an appliance vendor
you own it to yourself to at least ASK vernon how much.
(disclaimer: I don't sell DCC, don't know why I am advising competitors
to use DCC since it is one of our advantages, but I like the product,
the service and I like vernon)
*
what did you upgrade?
Sorry, I upgraded from Debian etch to Debian Lenny, along with that came
an upgrade to spamassassin.
micah
--
Michael Scheidell, CTO
Phone: 561-999-5000, x 1259
> *| *SECNAP Network Security Corporation
* Certified SNORT Integrator
* 2008-9 Hot Company Award Winner, World Executive Alliance
* Five-Star Partner Program 2009, VARBusiness
* Best Anti-Spam Product 2008, Network Products Guide
* King of Spam Filters, SC Magazine 2008
______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________
