But
There are some spammers who run "subscribe to" mailing lists.
I got spam at home the other day from ediets.co.uk, for example.
I call this stuff "subscription spam" and would block most of it anyway.
Cheers,
Phil
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK
Message
From: qqqq [mailto:qqqq (AT) usermail (DOT) com]
Sent: 08 May 2006 22:38
To: dallase (AT) uribl (DOT) com; users (AT) spamassassin (DOT) apache.org
Subject: My only problem with URIBL_BLACK
I probably get a FP about once a week as somebody will opt in
a mailing list and a listed URL is in
the mailing.
When I get these complaints, I exempt the mailing list from
the procmail rules so that the mailing
list doesn't get scanned by SA.
Just my 2 cents.
QQQQ
| This isn't to say that URIBL_BLACK isn't useful, or that you
| guys aren't doing a good job. However, this is good evidence
| you guys are doing great, but you do still have some areas
| that could use improvement.
| >
|
| thanks, i think. ;)
|
| our fp ratio for ham has always been hanging at that level.
i think thats a
| good sign. it means the data in our zones that are causing
those ham hits
| have not changed, and no one has notified us that they need removal.
| doesnt worry me a bit.
|
| we welcome your delist requests if you actually find a FP
(that we can agree
| on) on black.uribl.com. :)
|
| d
|
|

| But
|
| There are some spammers who run "subscribe to" mailing lists.
|
| I got spam at home the other day from ediets.co.uk, for example.
|
| I call this stuff "subscription spam" and would block most of it anyway.
|
| Cheers,
|
| Phil

Easier said than done when you have a paying customer who wants this specific mailing.

qqqq wrote:
| But
|
| There are some spammers who run "subscribe to" mailing lists.
|
| I got spam at home the other day from ediets.co.uk, for example.
|
| I call this stuff "subscription spam" and would block most of it anyway.
|
| Cheers,
|
| Phil

Easier said than done when you have a paying customer who wants this specific mailing.

Have you tried lowering the score of the spamassassin rules that are
getting hit?

Jay

| >
| Easier said than done when you have a paying customer who wants this specific mailing.
| >
| Have you tried lowering the score of the spamassassin rules that are
| getting hit?
|
| Jay

I'll look at a couple of the examples and see what else is firing. I may have to tune URI_BLACK
down a tad. I'll let you know.

QQQQ

qqqq wrote:
| >
| Easier said than done when you have a paying customer who wants this specific mailing.
| >
| Have you tried lowering the score of the spamassassin rules that are
| getting hit?
|
| Jay

I'll look at a couple of the examples and see what else is firing. I may have to tune URI_BLACK
down a tad. I'll let you know.

For reference, here's my running config:

urirhssub URIBL_BLACK multi.uribl.com. A 2
body URIBL_BLACK eval:check_uridnsbl('URIBL_BLACK')
describe URIBL_BLACK Contains an URL listed in the URIBL blacklist
tflags URIBL_BLACK net
score URIBL_BLACK 1.5

urirhssub URIBL_GREY multi.uribl.com. A 4
body URIBL_GREY eval:check_uridnsbl('URIBL_GREY')
describe URIBL_GREY Contains an URL listed in the URIBL greylist
tflags URIBL_GREY net
score URIBL_GREY 0.1

#adjustment to SURBL lists to control FPs with double-hits
meta URIBL_BLACKVERLAP (URIBL_BLACK && (URIBL_AB_SURBL || URIBL_JP_SURBL ||
URIBLB_SURBL || URIBL_WS_SURBL || URIBL_SC_SURBL))
score URIBL_BLACKVERLAP -1.0

Reasons:

I've scored URIBL_BLACK at 1.5 due to it having the worst S/ of any URIBL other
than PH and GREY. (0.993 in the mass-check Theo posted)

I've scored GREY at 0.1 as an informational rule. It's S/ is so poor it is more
qualified to be a nonspam rule. ( 0.354 in the nightly mass-check Theo posted)

I've added the overlap deduction because the scores of all the other URIBL's
hosted by surbl.org are already balanced and tuned for accuracy without
URIBL_BLACK. Adding more rules offsets that balance, and this tries to compensate.

The net effect of my configuration causes URIBL_BLACK to score 1.5 when it fires
alone, but drops it back to 0.5 when other SURBL lists fire.