Re: URIDNSBL but with full URL

2015-09-03 Thread Reindl Harald
Am 03.09.2015 um 14:06 schrieb Martin Gregorie: On Thu, 2015-09-03 at 12:28 +0200, Axb wrote: Please excuse my ignorance but wouldn't a key:value server like Redis do the trick? It can't get much faster than that.. ok.. maybe memcached Yes, I don't see why not: I hadn't considered Redis

Re: URIDNSBL but with full URL

2015-09-03 Thread Martin Gregorie
On Thu, 2015-09-03 at 12:28 +0200, Axb wrote: > Please excuse my ignorance > > but wouldn't a key:value server like Redis do the trick? > It can't get much faster than that.. ok.. maybe memcached > Yes, I don't see why not: I hadn't considered Redis because I thought that, like the Berkeley D

Re: URIDNSBL but with full URL

2015-09-03 Thread Axb
On 09/03/2015 12:18 PM, Martin Gregorie wrote: On Thu, 2015-09-03 at 11:15 +0700, Olivier Nicole wrote: Oh well, I will give a look at URIDNSBL and see whether/how I can change it. Implementing a simple lookup server using a hashtable of a B-tree can be very good performance, even from a singl

Re: URIDNSBL but with full URL

2015-09-03 Thread Martin Gregorie
On Thu, 2015-09-03 at 11:15 +0700, Olivier Nicole wrote: > Oh well, I will give a look at URIDNSBL and see whether/how I can > change > it. > Implementing a simple lookup server using a hashtable of a B-tree can be very good performance, even from a single-threaded local server. Back in 2000 I h

Re: URIDNSBL but with full URL

2015-09-02 Thread Olivier Nicole
Martin Gregorie writes: > On Wed, 2015-09-02 at 14:12 +0200, Axb wrote: > >> afaik, there is no code freely available to [recode the Malware >> Patrol rules], on server or client side. >> > ...the translation is easy to do with a simple awk script. Something > like this: > > #!/bin/bash > awk '

Re: URIDNSBL but with full URL

2015-09-02 Thread Paul Stead
On 02/09/15 10:10, Sujit Acharyya-choudhury wrote: It seems from the web site, one can use ClamAV and SaneSecurity to add extra signatures. Would it not be more efficient? http://sanesecurity.com/usage/signatures/ Second! -- Paul Stead Systems Engineer Zen Internet

Re: URIDNSBL but with full URL

2015-09-02 Thread John Hardin
On Wed, 2 Sep 2015, Axb wrote: On 09/02/15 16:12, John Hardin wrote: On Wed, 2 Sep 2015, Olivier Nicole wrote: > Malware Patrol (malwarepatrol.net) has a file with over 100,000 rules of > the form: > > body MBL_2931645/files\.oqayiq\.biz\/javasoft\/different\//i > > This causes

Re: URIDNSBL but with full URL

2015-09-02 Thread Axb
On 09/02/15 16:12, John Hardin wrote: On Wed, 2 Sep 2015, Olivier Nicole wrote: Malware Patrol (malwarepatrol.net) has a file with over 100,000 rules of the form: body MBL_2931645/files\.oqayiq\.biz\/javasoft\/different\//i This causes spamassassin --lint to never terminate (well, I k

Re: URIDNSBL but with full URL

2015-09-02 Thread John Hardin
On Wed, 2 Sep 2015, Olivier Nicole wrote: Malware Patrol (malwarepatrol.net) has a file with over 100,000 rules of the form: body MBL_2931645/files\.oqayiq\.biz\/javasoft\/different\//i This causes spamassassin --lint to never terminate (well, I killed it afetr one hour). I w

Re: URIDNSBL but with full URL

2015-09-02 Thread Axb
On 09/02/15 15:48, Martin Gregorie wrote: On Wed, 2015-09-02 at 14:12 +0200, Axb wrote: afaik, there is no code freely available to [recode the Malware Patrol rules], on server or client side. ...the translation is easy to do with a simple awk script. Something like this: #!/bin/bash awk '

Re: URIDNSBL but with full URL

2015-09-02 Thread Martin Gregorie
On Wed, 2015-09-02 at 14:12 +0200, Axb wrote: > afaik, there is no code freely available to [recode the Malware > Patrol rules], on server or client side. > ...the translation is easy to do with a simple awk script. Something like this: #!/bin/bash awk ' /body/ { url = substr($3,2);

Re: URIDNSBL but with full URL

2015-09-02 Thread Axb
On 09/02/15 11:21, Olivier Nicole wrote: Axb writes: On 09/02/15 09:51, Olivier Nicole wrote: Hi, I am looking at malware patrol, but they offer a list of over 300,000 rules, that is way too big. So I was considering using it in a URIDNSBL type of way, but including the full URL, not only t

Re: URIDNSBL but with full URL

2015-09-02 Thread Olivier Nicole
Axb writes: > On 09/02/15 09:51, Olivier Nicole wrote: >> Hi, >> >> I am looking at malware patrol, but they offer a list of over 300,000 >> rules, that is way too big. >> >> So I was considering using it in a URIDNSBL type of way, but including >> the full URL, not only the host part. It should

RE: URIDNSBL but with full URL

2015-09-02 Thread Sujit Acharyya-choudhury
Subject: Re: URIDNSBL but with full URL On 09/02/15 10:44, Reindl Harald wrote: > > > Am 02.09.2015 um 10:23 schrieb Axb: >> On 09/02/15 09:51, Olivier Nicole wrote: >>> Hi, >>> >>> I am looking at malware patrol, but they offer a list of over 300,000 >&g

Re: URIDNSBL but with full URL

2015-09-02 Thread Tom Hendrikx
On 02-09-15 10:44, Reindl Harald wrote: > > > Am 02.09.2015 um 10:23 schrieb Axb: >> On 09/02/15 09:51, Olivier Nicole wrote: >>> Hi, >>> >>> I am looking at malware patrol, but they offer a list of over 300,000 >>> rules, that is way too big. >>> >>> So I was considering using it in a URIDNSBL

Re: URIDNSBL but with full URL

2015-09-02 Thread Axb
On 09/02/15 10:44, Reindl Harald wrote: Am 02.09.2015 um 10:23 schrieb Axb: On 09/02/15 09:51, Olivier Nicole wrote: Hi, I am looking at malware patrol, but they offer a list of over 300,000 rules, that is way too big. So I was considering using it in a URIDNSBL type of way, but including t

Re: URIDNSBL but with full URL

2015-09-02 Thread Reindl Harald
Am 02.09.2015 um 10:23 schrieb Axb: On 09/02/15 09:51, Olivier Nicole wrote: Hi, I am looking at malware patrol, but they offer a list of over 300,000 rules, that is way too big. So I was considering using it in a URIDNSBL type of way, but including the full URL, not only the host part. It s

Re: URIDNSBL but with full URL

2015-09-02 Thread Axb
On 09/02/15 09:51, Olivier Nicole wrote: Hi, I am looking at malware patrol, but they offer a list of over 300,000 rules, that is way too big. So I was considering using it in a URIDNSBL type of way, but including the full URL, not only the host part. It should be able to accept things like foo