On Friday, April 9, 2004, 12:09:12 PM, Shaun Erickson wrote: > [EMAIL PROTECTED] wrote:
>> I have had quite a few come in this morning that Chris' rules hit, but the >> new SURBL did not hit.. I'll keep both running for a while, and see how >> things shake out! > You're right - I put BigEvil back in place, and it's flagging stuff that > SURBL isn't yet (but I'm sure will, later). So I'll run both for now, too. Bear in mind that we're not done tuning SURBL's use of our SpamCop data yet. Right now it is pretty conservative to prevent FPs. We have some strategies in the next version of the engine which should increase the hit rate without much increase in FPs: 'After watching the data for a while I think a longer general retention of say 10 days might be a good idea to catch reports over more than a week. For known spam gang domains/name servers/IPs we could make the retention a whole lot longer. And domains that get dozens to hundreds of reports should probably also be watched a lot longer using a longer retention. Domains that get reported most probably deserve the most attention through longer retention and perhaps a lower inclusion threshold. We would get external "known bad guys" data from (SBL) in order to adjust thresholds and expirations, but the inclusion of a domain in SURBL would still be triggered by SpamCop URI reports. But the trigger point would be lower for "bad guys".' Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED] http://www.surbl.org/
