>-----Original Message----- >From: Jeff Chan [mailto:[EMAIL PROTECTED] >Sent: Thursday, September 09, 2004 3:07 AM >To: [EMAIL PROTECTED] >Subject: SARE_FRAUD vs SURBLs (Was: RE: Mass-check errors) > > >On Wednesday, September 8, 2004, 7:12:26 AM, Smart,Dan Smart,Dan wrote: >> What I found was that the Textcat language rules was main time-sink, >> followed by the SARE_FRAUD ruleset. Since SURBL now has the >PH list, I >> removed the FRAUD ruleset too. > >Dan, >SARE_FRAUD has rules to catch text patterns in messages. It does >not look for phishing URI domains and IP addresses. Therefore PH >and SARE_FRAUD are not equivalent, and you may want to keep using >the SARE rule, even if you are using PH in multi.surbl.org. >
Ahhhh I missed this thread some how. So something in SARE_FRAUD is causing a slowdown? I've sent this to the ninjas. I will also look at this. I'm not familiar with Dprof at all. Time for another project I guess :) We are also still working on some eval things. Just throwing around ideas. Is it generally better to take a ruleset of say 30 avg size rules, and turn it into an eval? Does it gain, lose, or make no difference on performance? Also Dan, if you would be interested in doing performance testing on SARE stuff.....your Kung Fu looks pretty goood ;) Back on this topic, I think Dan is doing a trade off. Knowing that SARE_FRAUD and PH.surbl hit different things, yet same type spam, he is opting for the faster SURBL. --Chris
