Re: spam blocking engine

[Abdul Rehman Gani <abdulg_(_at_)_eastcoast_(_dot_)_co_(_dot_)_za>]

On Thursday 19 December 2002 14:29, Richard Welty wrote:
> On Wed, 18 Dec 2002 23:08:11 -0500 Marcus Watts <mdw_(_at_)_umich_(_dot_)_edu> wrote:
> > Getting a good list of open relays is hard.  The last time I looked
> > (which was, admittedly, a while ago) I did not find very good
> > correspondence between the sites from which I saw spam being
> > originated, and which sites were blocked in several popular lists.
>
> relays.visi.com was good, but it's been shut down.
>
> while i have philosophical objections to the ORBS style active scanning,
> one of the children of ORBS, ORDB, seems to be pretty accurate.

I also use ordb to good effect.

>
> >  How
> > good do you find the data from spews.org to be?
>
> what i've seen of spews suggests that the initial listings may be of high
> quality, but mr. spews plays escallation games with intentional collateral
> damage affecting folks with adjacent netblocks. whether this is acceptable
> is again a matter of personal philosophy.

I agree - spews incurs way too much collateral damage - we have stopped using 
them for this reason.

>
> my question: would the source for ips to be blocked be something that's
> configurable via a DNSBL parameter in a config file? in this case, there
> could be a reasonable default which could be tweaked to taste, with a list
> of DNSBLs to be queried.

This is possibly the best solution as it will leave the decision of which list 
to use in the administrator's hands.

Abdul
-- 
http://www.eastcoast.co.za
Tel: +27-31-566-8080
Fax: +27-31-566-8010
Email: support_(_at_)_eastcoast_(_dot_)_co_(_dot_)_za