Re: yet another uribl evasion example

2005-06-20 Thread Nix
On Mon, 13 Jun 2005, Theo Van Dinter uttered the following: > On Mon, Jun 13, 2005 at 09:42:35PM +0200, wolfgang wrote: >> - 3.0.4 appears to bring new challenges (Net::DNS version and such) > > 3.0.4 should be a drop-in replacement for earlier versions. People seem > to be having issues if they

Re: yet another uribl evasion example

2005-06-13 Thread Loren Wilton
> would it be reasonable to add a rule to check for anomalies in URLs? > what's the best (TM) way? SARE, at least at the moment. Loren

Re: yet another uribl evasion example

2005-06-13 Thread Robert Menschel
Hello mouss, Monday, June 13, 2005, 8:15:27 AM, you wrote: m> I just got the spam below (headers removed except few). m> would it be reasonable to add a rule to check for anomalies in URLs? m> what's the best (TM) way? 1) As has been suggested, upgrade. 2) Grab the SARE header rules file, whic

Re: yet another uribl evasion example

2005-06-13 Thread mouss
Theo Van Dinter wrote: On Mon, Jun 13, 2005 at 05:15:27PM +0200, mouss wrote: however, it doesn't trigger surbl checks, since the '&' is considered as the end of the url. What version are you running? This was fixed in 3.0.4. thanks for the reply. I am running 3.0.3. time to upgrade...

Re: yet another uribl evasion example

2005-06-13 Thread Bill Landry
- Original Message - From: "Michele Neylon:: Blacknight" <[EMAIL PROTECTED]> > Niek wrote: > > Eer, no. You can keep 0.49. Only if you upgrade netdns to the b0rked 0.50, > > you'll run into trouble. So either keep netdns @ 0.49 or upgrade to 0.51. > > Upgrading is not needed for sa 3.0.4

Re: yet another uribl evasion example

2005-06-13 Thread Michele Neylon:: Blacknight
Niek wrote: > Eer, no. You can keep 0.49. Only if you upgrade netdns to the b0rked 0.50, > you'll run into trouble. So either keep netdns @ 0.49 or upgrade to 0.51. > Upgrading is not needed for sa 3.0.4 afaik. > > Niek Baakman > 0.51 gives me the same problems :)

Re: yet another uribl evasion example

2005-06-13 Thread Theo Van Dinter
On Mon, Jun 13, 2005 at 09:42:35PM +0200, wolfgang wrote: > - 3.0.4 appears to bring new challenges (Net::DNS version and such) 3.0.4 should be a drop-in replacement for earlier versions. People seem to be having issues if they also upgrade Net::DNS, but there's no requirement to do so. 3.0.4 fi

Re: yet another uribl evasion example

2005-06-13 Thread Niek
On 6/13/2005 9:42 PM +0200, wolfgang wrote: - 3.0.4 appears to bring new challenges (Net::DNS version and such) Eer, no. You can keep 0.49. Only if you upgrade netdns to the b0rked 0.50, you'll run into trouble. So either keep netdns @ 0.49 or upgrade to 0.51. Upgrading is not needed for sa 3.0

Re: yet another uribl evasion example

2005-06-13 Thread wolfgang
In an older episode (Monday 13 June 2005 21:20), Raymond Dijkxhoorn wrote: > Any reason not wanting to upgrade to 3.0.4 ? yes. - our spamchecker machines' distributor is slow with upgrades while i can patch existing 3.0.2 code on them. - 3.0.4 appears to bring new challenges (Net::DNS version a

Re: yet another uribl evasion example

2005-06-13 Thread Raymond Dijkxhoorn
Hi! On Mon, Jun 13, 2005 at 05:15:27PM +0200, mouss wrote: however, it doesn't trigger surbl checks, since the '&' is considered as the end of the url. What version are you running? This was fixed in 3.0.4. can the fix be applied to 3.0.3? Any reason not wanting to upgrade to 3.0.4 ?

Re: yet another uribl evasion example

2005-06-13 Thread wolfgang
In an older episode (Monday 13 June 2005 18:10), Theo Van Dinter wrote: > On Mon, Jun 13, 2005 at 05:15:27PM +0200, mouss wrote: > > however, it doesn't trigger surbl checks, since the '&' is considered > > as the end of the url. > > What version are you running? This was fixed in 3.0.4. can t

Re: yet another uribl evasion example

2005-06-13 Thread Theo Van Dinter
On Mon, Jun 13, 2005 at 05:15:27PM +0200, mouss wrote: > however, it doesn't trigger surbl checks, since the '&' is considered > as the end of the url. What version are you running? This was fixed in 3.0.4. -- Randomly Generated Tagline: Farfignewton.. the cookie of the stars.. pgpsZrzZT49i

yet another uribl evasion example

2005-06-13 Thread mouss
I just got the spam below (headers removed except few). this hasn't been caught at reception time. It now triggers RCVD_IN_BL_SPAMCOP_NET. however, it doesn't trigger surbl checks, since the '&' is considered as the end of the url. debug: URIDNSBL: domains to query: ins.com nusv.com